alert tcp [$HOME_NET,$HTTP_SERVERS] any -> $EXTERNAL_NET any (
msg:"ET POLICY GIOP/IIOP Request Outbound";
flow:established,to_server;
flowbits:set,ET.GIOPsession;
stream_size:server,<,5;
content:"|47 49 4f 50 01|"; startswith;
content:"|00|"; distance:2; within:1;
classtype:policy-violation;
sid:2034730; rev:1;
metadata:attack_target Client_and_Server, created_at 2021_12_15, deployment Perimeter, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_12_15;
)