alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Tor2Web .onion Proxy Service SSL Cert (1)"; flow:established,to_client; tls.cert_subject; content:"CN=*.tor2web."; nocase; fast_pattern; reference:url,uscyberlabs.com/blog/2013/04/30/tor-exploit-pak/; classtype:misc-activity; sid:2016806; rev:7; metadata:attack_target Client_Endpoint, created_at 2013_05_02, deployment Perimeter, confidence High, signature_severity Informational, tag TOR_Proxy, updated_at 2023_04_20;)