alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"POLICY [PTsecurity] Telegram Messenger"; flow:established, to_server; dsize:89; stream_size:client, <,2700; flowbits:isset, FB_Telegram_3; flowbits:unset, FB_Telegram_3; threshold:type limit, track by_src, count 1, seconds 300; classtype:misc-activity; metadata:created_at 2017_7_19; reference:url, github.com/ptresearch/AttackDetection; sid:11001582; rev:1;)