alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"APP [PTsecurity] MTproto Telegram pkt chk#1"; flow:established, to_client; dsize:100<>120; stream_size:server, >,100; stream_size:server, <,200; stream_size:client, >,130; stream_size:client, <,300; flowbits:isset, FBMproto_0; flowbits:unset, FBMproto_0; flowbits:set, FBMproto_1; flowbits:noalert; pcre:"/[\x09-\x0e]/"; reference:url, github.com/ptresearch/AttackDetection; metadata:autosign, id_0; metadata:created_at 2019_02_19, updated_at 2021_03_20; classtype:misc-activity; sid:11004535; rev:3;)