alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET INFO Outbound MSSQL Connection to Standard port (1433)"; flow:established,to_server; flowbits:set,ET.MSSQL; content:"|12 01 00|"; depth:3; content:"|00 00 00 00 00 00 15 00 06 01 00 1b 00 01 02 00 1c 00|"; distance:1; within:18; content:"|03 00|"; distance:1; within:2; content:"|00 04 ff 08 00 01 55 00 00 00|"; distance:1; within:10; classtype:bad-unknown; sid:2013410; rev:6; metadata:created_at 2011_08_16, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)