Rule History

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SUSPICIOUS [PTsecurity] Unusual TOR SSL Activity FB set FB167479_1"; flow: established, to_client; content: "|17 03 01 00 20|"; fast_pattern; depth: 5; content: "|1703|"; distance: 32; within: 2; stream_size: server, >,2523; stream_size: client, >,429; stream_size: server, <,4000; stream_size: client, <,2261; flowbits: noalert; flowbits: isset, FB167479_0; flowbits: unset, FB167479_0; flowbits: set, FB167479_1; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 11001540; rev: 9;)