alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"SUSPICIOUS [PTsecurity] Dropbox SSL Payload Request"; flow:established, to_server; content:"|1703 0101 70|"; depth:5; fast_pattern; content:!"|1703|"; distance:368; within:2; stream_size:server, <,5891; stream_size:client, >,0; stream_size:server, >,0; stream_size:client, <,1014; flowbits:isset, FB309001_0; flowbits:unset, FB309001_0; flowbits:set, FB309001_1; classtype:misc-activity; metadata:created_at 2017_8_8; reference:url, github.com/ptresearch/AttackDetection; sid:11001735; rev:1;)