alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"APP [PTsecurity] MTproto Telegram"; flow:established, to_server; dsize:250<>350; stream_size:server, >,250; stream_size:server, <,600; stream_size:client, >,460; stream_size:client, <,1000; flowbits:isset, FBMproto_3; flowbits:unset, FBMproto_3; pcre:"/[\x09-\x0e]/"; reference:url, github.com/ptresearch/AttackDetection; metadata:autosign, id_0; metadata:created_at 2019_02_19, updated_at 2019_07_25; classtype:misc-activity; sid:11004538; rev:2;)