alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Tor2Web .onion Proxy Service SSL Cert (2)"; flow:established,to_client; tls.cert_subject; content:"CN=*.onion."; nocase; pcre:"/^(?:sh|lu|to)/Ri"; reference:url,uscyberlabs.com/blog/2013/04/30/tor-exploit-pak/; classtype:misc-activity; sid:2016810; rev:8; metadata:attack_target Client_Endpoint, created_at 2013_05_02, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag TOR_Proxy, updated_at 2023_05_25;)