alert tcp any ![21,25,110,143,443,465,587,636,989:995,5061,5222,8443] -> any any (msg:"ET POLICY TLS possible TOR SSL traffic"; flow:established,from_server; tls.cert_issuer; content:"CN=www"; startswith; content:".com"; endswith; pcre:"/^CN=www\.[0-9a-z]{8,20}\.com$/"; tls.cert_subject; content:"CN=www"; startswith; content:".net"; endswith; pcre:"/^CN=www\.[0-9a-z]{8,20}\.net$/"; classtype:misc-activity; sid:2018789; rev:4; metadata:created_at 2014_07_28, confidence High, signature_severity Informational, updated_at 2023_02_16;)