ET POLICY Possible SSLv2 Negotiation in Progress Server Hello

alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET POLICY Possible SSLv2 Negotiation in Progress Server Hello";
    flow:from_server,established;
    content:"|04 00 01 00 02|"; offset:2; depth:5;
    byte_test:2,>,15,4,relative;
    byte_test:2,<,33,4,relative;
    flowbits:set,SSlv2.ServerHello;
    flowbits:noalert;
    reference:url,drownattack.com/drown-attack-paper.pdf;
    classtype:policy-violation;
    sid:2022583; rev:1;
    metadata:created_at 2016_03_02, confidence Medium, signature_severity Informational, updated_at 2019_07_26;
)