---

# 1. Блокировка FTP — команды USER и PASS в открытом тексте
drop tcp any any -> any 21 (msg:"BLOCK FTP USER command"; \
  flow:to_server,established; \
  content:"USER"; nocase; depth:10; \
  sid:1000001; rev:1;)

drop tcp any any -> any 21 (msg:"BLOCK FTP PASS command"; \
  flow:to_server,established; \
  content:"PASS"; nocase; depth:10; \
  sid:1000002; rev:1;)

# 2. Блокировка HTTP к zapret.telegram по заголовку Host
drop http any any -> any 80 (msg:"BLOCK HTTP zapret.telegram"; \
  http.header; content:"Host: zapret.telegram"; nocase; \
  sid:1000003; rev:1;)

# 3. Блокировка HTTP с User-Agent Windows PowerShell
drop http any any -> any any (msg:"BLOCK HTTP User-Agent PowerShell"; \
  http.user_agent; content:"Windows PowerShell"; nocase; \
  sid:1000004; rev:1;)