alert tcp any any -> any 389 (msg:"⚠ LDAP password ➡ sent in clear text 👀 - Leak 🚱"; flow:established, to_server, no_stream; threshold:type limit, track by_src,count 1, seconds 3600; content:"|30|"; depth:1; content:"|02 01|"; fast_pattern; distance:1; within:2; content:"|60|"; distance:1; within:1; content:"|02 01|"; distance:1; within:2; content:"|04|"; distance:1; within:1; byte_jump:1, 0, relative; content:"|80|"; within:1; content:!"|00|"; within:1; reference:url,https://github.com/ptresearch/AttackDetection/blob/master/policy/policy.rules; sid:3300341; metadata:created_at 2020_10_25, updated_at 2026_05_17; rev:4; classtype:policy-violation;)