alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"APP [PTsecurity] MTproto Telegram pkt chk#0"; flow:established, to_server; dsize:130<>240; content:!"|1603|"; depth:2; stream_size:server, =, 1; stream_size:server, =, 1; stream_size:client, >,130; stream_size:client, <,300; flowbits:set, FBMproto_0; flowbits:noalert; pcre:"/[\x09-\x0e]/"; reference:url, github.com/ptresearch/AttackDetection; metadata:autosign, id_0; metadata:created_at 2019_02_19, updated_at 2021_03_20; classtype:misc-activity; sid:11004534; rev:4;)