alert tcp any any -> $HOME_NET any (msg:"ET SCAN Nmap NSE Heartbleed Request"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; content:"|01|"; offset:5; depth:1; byte_test:2,>,2,3; byte_test:2,>,200,6; content:"|40 00|Nmap ssl-heartbleed"; fast_pattern; classtype:attempted-recon; sid:2021023; rev:2; metadata:created_at 2015_04_28, confidence Medium, signature_severity Minor, updated_at 2022_03_17, reviewed_at 2024_04_19;)