alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO QUIC UDP Internet Connections Protocol Client Hello (OUTBOUND)"; flow:to_server; flowbits:set,ET.QUIC.FirstClientHello; content:"|80 01|CHLO"; content:"PAD"; content:"SNI"; content:"CCS"; content:"PDMD"; content:"VERS"; nocase; reference:url,tools.ietf.org/html/draft-tsvwg-quic-protocol-00; classtype:protocol-command-decode; sid:2022996; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_08_01, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_03_15;)