Rule History

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SUSPICIOUS [PTsecurity] Unusual TOR SSL Activity FB set FB167479_3"; flow: established, to_client; content: "|17 03 01 00 20|"; fast_pattern; depth: 5; content: "|1703|"; distance: 32; within: 2; stream_size: server, >,3739; stream_size: client, >,1601; stream_size: server, <,4856; stream_size: client, <,2261; flowbits: noalert; flowbits: isset, FB167479_2; flowbits: unset, FB167479_2; flowbits: set, FB167479_3; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 11001542; rev: 9;)