""ET POLICY TLS possible TOR SSL traffic""
SID: 2018789
Revision: 3
Class Type: misc-activity
Metadata: created_at 2014_07_28, updated_at 2023_02_16
Reference:
Protocol: tcp
Source Network: any
Source Port: ![21,25,110,143,443,465,587,636,989:995,5061,5222,8443]
Destination Network: any
Destination Port: any
Flow: established,from_server
Contents:
-
Value: "|06 03 55 04 03|"
-
Value: "|06 03 55 04 03|"
Within:
PCRE: "/^.{2}www.[0-9a-z]{8,20}.net/Rs"
Special Options: