ET POLICY Possible ethereum traffic

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET POLICY Possible ethereum traffic";
    flow:established,to_server;
    content:"POST"; depth:4;
    content:"|22|id|22 3a|"; nocase; distance:0;
    content:"|22|jsonrpc|22 3a|"; nocase; distance:0;
    content:"|22|method|22 3a|"; nocase; distance:0;
    pcre:"/^[^/s]*(?:eth_(?:g(?:et(?:B(?:lock(?:TransactionCountBy(?:Number|Hash)|By(?:Number|Hash))|alance)|Transaction(?:By(?:Block(?:Number|Hash)AndIndex|Hash)|(?:Receip|Coun)t)|Uncle(?:ByBlock(?:Number|Hash)AndIndex|CountByBlock(?:Number|Hash))|(?:Filter(?:Change|Log)|Log)s|Co(?:mpilers|de)|StorageAt|Work)|asPrice)|(?:(?:new(?:PendingTransaction|Block)?|uninstall)Filt|blockNumb)er|s(?:(?:end(?:Raw)?Transactio|ig)n|ubmit(?:Hashrate|Work)|yncing)|c(?:o(?:mpile(?:S(?:olidity|erpent)|LLL)|inbase)|all)|(?:estimateGa|account)s|protocolVersion|hashrate|mining)|shh_(?:new(?:Identity|Filter|Group)|get(?:FilterChan|Messa)ges|uninstallFilter|hasIdentity|addToGroup|version|post)|db_(?:get(?:String|Hex)|put(?:String|Hex))|net_(?:listening|peerCount|version)|web3_(?:clientVersion|sha3))/R";
    reference:url,github.com/ethereum/wiki/wiki/JSON-RPC;
    classtype:policy-violation;
    sid:2021983; rev:2;
    metadata:created_at 2015_10_20, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;
)