Rule History

alert tls any any -> any any (msg: "TOOLS [PTsecurity] Telebit tunnel TLS request"; flow: established, to_server; tls.sni; content: ".telebit.io"; nocase; threshold: type limit, track by_src, seconds 300, count 1; reference: url, telebit.cloud; reference: url, rules.ptsecurity.com; classtype: policy-violation; sid: 10012989; rev: 1;)