alert tcp any any -> any 389 (msg:"POLICY [PTsecurity] LDAP Cleartext credentials exposure"; flow:established, to_server, no_stream; content:"|30|"; depth:1; content:"|02 01|"; distance:1; within:2; content:"|60|"; distance:1; within:1; content:"|02 01|"; distance:1; within:2; content:"|04|"; distance:1; within:1; byte_jump:1, 0, relative; content:"|80|"; within:1; content:!"|00|"; within:1; reference:url, github.com/ptresearch/AttackDetection; classtype:successful-recon-limited; sid:10002317; rev:2;)