ET POLICY ToDesk Remote Access Control Tool

alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET 443 (
    msg:"ET POLICY ToDesk Remote Access Control Tool";
    flow:established,to_server;
    content:"|00 00 00|"; startswith;
    content:"|01 0a 20|"; offset:4; depth:3;
    content:"|12|"; offset:39; depth:1;
    byte_jump:1,0,relative;
    content:"|18 01 22|"; within:3;
    byte_jump:1,0,relative;
    content:"|3a 3f|"; within:2;
    content:"B$"; distance:63; within:2;
    isdataat:!68,relative;
    reference:md5,d428709903e8c86bc02dfc29ab903634;
    classtype:policy-violation;
    sid:2031242; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_11_30, deployment Perimeter, performance_impact Significant, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_30;
)