alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - 4shared - DNS request for 4shared.com"; dns.query; content:"4shared.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - 4shared - Related URL (4shared.com)"; http.uri; content:"4shared.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000001; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - 4shared - Related TLS SNI (4shared.com)"; tls.sni; content:"4shared.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000002; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Box.net - DNS request for box.net"; dns.query; content:"box.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Box.net - Related URL (box.net)"; http.uri; content:"box.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000004; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Box.net - Related TLS SNI (box.net)"; tls.sni; content:"box.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000005; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Depositfiles - DNS request for depositfiles.com"; dns.query; content:"depositfiles.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Depositfiles - Related URL (depositfiles.com)"; http.uri; content:"depositfiles.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000007; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Depositfiles - Related TLS SNI (depositfiles.com)"; tls.sni; content:"depositfiles.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000008; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Dropbox - DNS request for dropboxusercontent.com"; dns.query; content:"dropboxusercontent.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Dropbox - Related URL (dropboxusercontent.com)"; http.uri; content:"dropboxusercontent.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000010; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Dropbox - Related TLS SNI (dropboxusercontent.com)"; tls.sni; content:"dropboxusercontent.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000011; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Dropbox - DNS request for dropbox.com"; dns.query; content:"dropbox.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Dropbox - Related URL (dropbox.com)"; http.uri; content:"dropbox.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000013; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Dropbox - Related TLS SNI (dropbox.com)"; tls.sni; content:"dropbox.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000014; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Dropbox - DNS request for dropboxapi.com"; dns.query; content:"dropboxapi.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Dropbox - Related URL (dropboxapi.com)"; http.uri; content:"dropboxapi.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000016; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Dropbox - Related TLS SNI (dropboxapi.com)"; tls.sni; content:"dropboxapi.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000017; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Mediafire - DNS request for mediafire.com"; dns.query; content:"mediafire.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Mediafire - Related URL (mediafire.com)"; http.uri; content:"mediafire.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000019; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Mediafire - Related TLS SNI (mediafire.com)"; tls.sni; content:"mediafire.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000020; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Mega - DNS request for mega.nz"; dns.query; content:"mega.nz"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Mega - Related URL (mega.nz)"; http.uri; content:"mega.nz"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000022; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Mega - Related TLS SNI (mega.nz)"; tls.sni; content:"mega.nz"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000023; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Mega - DNS request for mega.co.nz"; dns.query; content:"mega.co.nz"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Mega - Related URL (mega.co.nz)"; http.uri; content:"mega.co.nz"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000025; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Mega - Related TLS SNI (mega.co.nz)"; tls.sni; content:"mega.co.nz"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000026; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Rutracker - DNS request for rutracker.org"; dns.query; content:"rutracker.org"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Rutracker - Related URL (rutracker.org)"; http.uri; content:"rutracker.org"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000028; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Rutracker - Related TLS SNI (rutracker.org)"; tls.sni; content:"rutracker.org"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000029; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - WeTransfer - DNS request for wetransfer.com"; dns.query; content:"wetransfer.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - WeTransfer - Related URL (wetransfer.com)"; http.uri; content:"wetransfer.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000031; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - WeTransfer - Related TLS SNI (wetransfer.com)"; tls.sni; content:"wetransfer.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000032; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Xunlei - DNS request for xunlei.com"; dns.query; content:"xunlei.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Xunlei - Related URL (xunlei.com)"; http.uri; content:"xunlei.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000034; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Xunlei - Related TLS SNI (xunlei.com)"; tls.sni; content:"xunlei.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000035; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - rapidgator - DNS request for rapidgator.net"; dns.query; content:"rapidgator.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - rapidgator - Related URL (rapidgator.net)"; http.uri; content:"rapidgator.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000037; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - rapidgator - Related TLS SNI (rapidgator.net)"; tls.sni; content:"rapidgator.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000038; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - filefactory - DNS request for filefactory.com"; dns.query; content:"filefactory.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - filefactory - Related URL (filefactory.com)"; http.uri; content:"filefactory.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000040; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - filefactory - Related TLS SNI (filefactory.com)"; tls.sni; content:"filefactory.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000041; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - turbobit - DNS request for turbobit.net"; dns.query; content:"turbobit.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - turbobit - Related URL (turbobit.net)"; http.uri; content:"turbobit.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000043; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - turbobit - Related TLS SNI (turbobit.net)"; tls.sni; content:"turbobit.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000044; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - 1fichier - DNS request for 1fichier.com"; dns.query; content:"1fichier.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - 1fichier - Related URL (1fichier.com)"; http.uri; content:"1fichier.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000046; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - 1fichier - Related TLS SNI (1fichier.com)"; tls.sni; content:"1fichier.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000047; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - free.fr - DNS request for dl.free.fr"; dns.query; content:"dl.free.fr"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - free.fr - Related URL (dl.free.fr)"; http.uri; content:"dl.free.fr"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000049; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - free.fr - Related TLS SNI (dl.free.fr)"; tls.sni; content:"dl.free.fr"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000050; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - grosfichier - DNS request for grosfichiers.com"; dns.query; content:"grosfichiers.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - grosfichier - Related URL (grosfichiers.com)"; http.uri; content:"grosfichiers.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000052; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - grosfichier - Related TLS SNI (grosfichiers.com)"; tls.sni; content:"grosfichiers.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000053; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Box - DNS request for box.com"; dns.query; content:"box.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Box - Related URL (box.com)"; http.uri; content:"box.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000055; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Box - Related TLS SNI (box.com)"; tls.sni; content:"box.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000056; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Google_Drive - DNS request for drive.google.com"; dns.query; content:"drive.google.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Google_Drive - Related URL (drive.google.com)"; http.uri; content:"drive.google.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000058; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Google_Drive - Related TLS SNI (drive.google.com)"; tls.sni; content:"drive.google.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000059; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - OneDrive - DNS request for onedrive.live.com"; dns.query; content:"onedrive.live.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - OneDrive - Related URL (onedrive.live.com)"; http.uri; content:"onedrive.live.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000061; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - OneDrive - Related TLS SNI (onedrive.live.com)"; tls.sni; content:"onedrive.live.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000062; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - OneDrive - DNS request for onedrive.com"; dns.query; content:"onedrive.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - OneDrive - Related URL (onedrive.com)"; http.uri; content:"onedrive.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000064; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - OneDrive - Related TLS SNI (onedrive.com)"; tls.sni; content:"onedrive.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000065; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - iCloud - DNS request for icloud-content.com"; dns.query; content:"icloud-content.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - iCloud - Related URL (icloud-content.com)"; http.uri; content:"icloud-content.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000067; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - iCloud - Related TLS SNI (icloud-content.com)"; tls.sni; content:"icloud-content.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000068; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Proton_Drive - DNS request for drive.proton.me"; dns.query; content:"drive.proton.me"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Proton_Drive - Related URL (drive.proton.me)"; http.uri; content:"drive.proton.me"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000070; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Proton_Drive - Related TLS SNI (drive.proton.me)"; tls.sni; content:"drive.proton.me"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000071; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - pCloud - DNS request for pcloud.com"; dns.query; content:"pcloud.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - pCloud - Related URL (pcloud.com)"; http.uri; content:"pcloud.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000073; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - pCloud - Related TLS SNI (pcloud.com)"; tls.sni; content:"pcloud.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000074; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - pCloud - DNS request for transfer.pcloud.com"; dns.query; content:"transfer.pcloud.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - pCloud - Related URL (transfer.pcloud.com)"; http.uri; content:"transfer.pcloud.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000076; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - pCloud - Related TLS SNI (transfer.pcloud.com)"; tls.sni; content:"transfer.pcloud.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000077; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Terabox - DNS request for terabox.com"; dns.query; content:"terabox.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Terabox - Related URL (terabox.com)"; http.uri; content:"terabox.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000079; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Terabox - Related TLS SNI (terabox.com)"; tls.sni; content:"terabox.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000080; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Terabox - DNS request for teraboxapp.com"; dns.query; content:"teraboxapp.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Terabox - Related URL (teraboxapp.com)"; http.uri; content:"teraboxapp.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000082; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Terabox - Related TLS SNI (teraboxapp.com)"; tls.sni; content:"teraboxapp.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000083; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Gofile - DNS request for gofile.io"; dns.query; content:"gofile.io"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Gofile - Related URL (gofile.io)"; http.uri; content:"gofile.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000085; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Gofile - Related TLS SNI (gofile.io)"; tls.sni; content:"gofile.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000086; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Pixeldrain - DNS request for pixeldrain.com"; dns.query; content:"pixeldrain.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Pixeldrain - Related URL (pixeldrain.com)"; http.uri; content:"pixeldrain.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000088; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Pixeldrain - Related TLS SNI (pixeldrain.com)"; tls.sni; content:"pixeldrain.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000089; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Smash - DNS request for fromsmash.com"; dns.query; content:"fromsmash.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Smash - Related URL (fromsmash.com)"; http.uri; content:"fromsmash.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000091; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Smash - Related TLS SNI (fromsmash.com)"; tls.sni; content:"fromsmash.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000092; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - SwissTransfer - DNS request for swisstransfer.com"; dns.query; content:"swisstransfer.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - SwissTransfer - Related URL (swisstransfer.com)"; http.uri; content:"swisstransfer.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000094; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - SwissTransfer - Related TLS SNI (swisstransfer.com)"; tls.sni; content:"swisstransfer.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000095; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - TransferNow - DNS request for transfernow.net"; dns.query; content:"transfernow.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - TransferNow - Related URL (transfernow.net)"; http.uri; content:"transfernow.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000097; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - TransferNow - Related TLS SNI (transfernow.net)"; tls.sni; content:"transfernow.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000098; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Filemail - DNS request for filemail.com"; dns.query; content:"filemail.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Filemail - Related URL (filemail.com)"; http.uri; content:"filemail.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000100; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Filemail - Related TLS SNI (filemail.com)"; tls.sni; content:"filemail.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000101; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - WorkUpload - DNS request for workupload.com"; dns.query; content:"workupload.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - WorkUpload - Related URL (workupload.com)"; http.uri; content:"workupload.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000103; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - WorkUpload - Related TLS SNI (workupload.com)"; tls.sni; content:"workupload.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000104; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - KrakenFiles - DNS request for krakenfiles.com"; dns.query; content:"krakenfiles.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - KrakenFiles - Related URL (krakenfiles.com)"; http.uri; content:"krakenfiles.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000106; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - KrakenFiles - Related TLS SNI (krakenfiles.com)"; tls.sni; content:"krakenfiles.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000107; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Catbox - DNS request for catbox.moe"; dns.query; content:"catbox.moe"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Catbox - Related URL (catbox.moe)"; http.uri; content:"catbox.moe"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000109; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Catbox - Related TLS SNI (catbox.moe)"; tls.sni; content:"catbox.moe"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000110; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Sendspace - DNS request for sendspace.com"; dns.query; content:"sendspace.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Sendspace - Related URL (sendspace.com)"; http.uri; content:"sendspace.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000112; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Sendspace - Related TLS SNI (sendspace.com)"; tls.sni; content:"sendspace.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000113; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Send_Anywhere - DNS request for send-anywhere.com"; dns.query; content:"send-anywhere.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Send_Anywhere - Related URL (send-anywhere.com)"; http.uri; content:"send-anywhere.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000115; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Send_Anywhere - Related TLS SNI (send-anywhere.com)"; tls.sni; content:"send-anywhere.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000116; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - DDownload - DNS request for ddownload.com"; dns.query; content:"ddownload.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - DDownload - Related URL (ddownload.com)"; http.uri; content:"ddownload.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000118; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - DDownload - Related TLS SNI (ddownload.com)"; tls.sni; content:"ddownload.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000119; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - MegaUp - DNS request for megaup.net"; dns.query; content:"megaup.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - MegaUp - Related URL (megaup.net)"; http.uri; content:"megaup.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000121; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - MegaUp - Related TLS SNI (megaup.net)"; tls.sni; content:"megaup.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000122; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - QIWI - DNS request for qiwi.gg"; dns.query; content:"qiwi.gg"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - QIWI - Related URL (qiwi.gg)"; http.uri; content:"qiwi.gg"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000124; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - QIWI - Related TLS SNI (qiwi.gg)"; tls.sni; content:"qiwi.gg"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000125; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Wormhole - DNS request for wormhole.app"; dns.query; content:"wormhole.app"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Wormhole - Related URL (wormhole.app)"; http.uri; content:"wormhole.app"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000127; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Wormhole - Related TLS SNI (wormhole.app)"; tls.sni; content:"wormhole.app"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000128; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - SendGB - DNS request for sendgb.com"; dns.query; content:"sendgb.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - SendGB - Related URL (sendgb.com)"; http.uri; content:"sendgb.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000130; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - SendGB - Related TLS SNI (sendgb.com)"; tls.sni; content:"sendgb.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000131; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - WeSendit - DNS request for wesendit.com"; dns.query; content:"wesendit.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - WeSendit - Related URL (wesendit.com)"; http.uri; content:"wesendit.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000133; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - WeSendit - Related TLS SNI (wesendit.com)"; tls.sni; content:"wesendit.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000134; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Tresorit - DNS request for tresorit.com"; dns.query; content:"tresorit.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Tresorit - Related URL (tresorit.com)"; http.uri; content:"tresorit.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000136; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Tresorit - Related TLS SNI (tresorit.com)"; tls.sni; content:"tresorit.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000137; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Sync - DNS request for sync.com"; dns.query; content:"sync.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Sync - Related URL (sync.com)"; http.uri; content:"sync.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000139; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Sync - Related TLS SNI (sync.com)"; tls.sni; content:"sync.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000140; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Internxt - DNS request for internxt.com"; dns.query; content:"internxt.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Internxt - Related URL (internxt.com)"; http.uri; content:"internxt.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000142; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Internxt - Related TLS SNI (internxt.com)"; tls.sni; content:"internxt.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000143; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - IceDrive - DNS request for icedrive.net"; dns.query; content:"icedrive.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - IceDrive - Related URL (icedrive.net)"; http.uri; content:"icedrive.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000145; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - IceDrive - Related TLS SNI (icedrive.net)"; tls.sni; content:"icedrive.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000146; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - FileBin - DNS request for filebin.net"; dns.query; content:"filebin.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - FileBin - Related URL (filebin.net)"; http.uri; content:"filebin.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000148; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - FileBin - Related TLS SNI (filebin.net)"; tls.sni; content:"filebin.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000149; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Uploadfiles - DNS request for uploadfiles.io"; dns.query; content:"uploadfiles.io"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Uploadfiles - Related URL (uploadfiles.io)"; http.uri; content:"uploadfiles.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000151; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Uploadfiles - Related TLS SNI (uploadfiles.io)"; tls.sni; content:"uploadfiles.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000152; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Uploadfiles - DNS request for ufile.io"; dns.query; content:"ufile.io"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Uploadfiles - Related URL (ufile.io)"; http.uri; content:"ufile.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000154; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Uploadfiles - Related TLS SNI (ufile.io)"; tls.sni; content:"ufile.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000155; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Snapdrop - DNS request for snapdrop.net"; dns.query; content:"snapdrop.net"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Snapdrop - Related URL (snapdrop.net)"; http.uri; content:"snapdrop.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000157; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Snapdrop - Related TLS SNI (snapdrop.net)"; tls.sni; content:"snapdrop.net"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000158; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Sharedrop - DNS request for sharedrop.io"; dns.query; content:"sharedrop.io"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Sharedrop - Related URL (sharedrop.io)"; http.uri; content:"sharedrop.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000160; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Sharedrop - Related TLS SNI (sharedrop.io)"; tls.sni; content:"sharedrop.io"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000161; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Fshare - DNS request for fshare.vn"; dns.query; content:"fshare.vn"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Fshare - Related URL (fshare.vn)"; http.uri; content:"fshare.vn"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000163; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Fshare - Related TLS SNI (fshare.vn)"; tls.sni; content:"fshare.vn"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000164; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Katfile - DNS request for katfile.com"; dns.query; content:"katfile.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Katfile - Related URL (katfile.com)"; http.uri; content:"katfile.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000166; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Katfile - Related TLS SNI (katfile.com)"; tls.sni; content:"katfile.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000167; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Nitroflare - DNS request for nitroflare.com"; dns.query; content:"nitroflare.com"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Nitroflare - Related URL (nitroflare.com)"; http.uri; content:"nitroflare.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000169; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Nitroflare - Related TLS SNI (nitroflare.com)"; tls.sni; content:"nitroflare.com"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000170; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Keep2Share - DNS request for k2s.cc"; dns.query; content:"k2s.cc"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Keep2Share - Related URL (k2s.cc)"; http.uri; content:"k2s.cc"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000172; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Keep2Share - Related TLS SNI (k2s.cc)"; tls.sni; content:"k2s.cc"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000173; rev:1;)
alert dns $HOME_NET any -> any 53 (msg:"OPN_File_Transfer - Keep2Share - DNS request for keep2share.cc"; dns.query; content:"keep2share.cc"; nocase; reference:url,file-transfer; classtype:policy-violation; sid:53000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"OPN_File_Transfer - Keep2Share - Related URL (keep2share.cc)"; http.uri; content:"keep2share.cc"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000175; rev:1;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"OPN_File_Transfer - Keep2Share - Related TLS SNI (keep2share.cc)"; tls.sni; content:"keep2share.cc"; flow:to_server,established; reference:url,file-transfer; classtype:policy-violation; sid:53000176; rev:1;)