Rule History

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SUSPICIOUS [PTsecurity] Unusual TOR SSL Activity FB set FB447357_3"; flow: established, to_client; content: "|1703 01 0020|"; depth: 5; fast_pattern; content: "|1703|"; distance: 32; within: 2; stream_size: server, >,3630; stream_size: server, <,3963; stream_size: client, >,1264; stream_size: client, <,2558; flowbits: noalert; flowbits: isset, FB447357_2; flowbits: unset, FB447357_2; flowbits: set, FB447357_3; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 11002433; rev: 6;)