Rule History

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SUSPICIOUS [PTsecurity] Unusual TOR SSL Activity FB set FB447357_1"; flow: established, to_client; content: "|1703 01 0020|"; depth: 5; fast_pattern; content: "|1703|"; distance: 32; within: 2; stream_size: server, >,2414; stream_size: server, <,3863; stream_size: client, >,166; stream_size: client, <,2558; flowbits: noalert; flowbits: isset, FB447357_0; flowbits: unset, FB447357_0; flowbits: set, FB447357_1; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 11002431; rev: 6;)