alert tcp any any -> any any (msg:"TOOLS [PTsecurity] Pinggy Tunnel Started"; flow:established, from_server; content:"SSH-"; depth:4; nocase; content:"-Pinggy.IO"; within:19; nocase; reference:url, pinggy.io; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10013586; rev:1;)