oracle.rules:alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 2481 (msg:"ORACLE TNS GIOP request size too large attempt"; flow:to_server,established; content:"|00|"; depth:1; byte_test:4,>,65534,1; classtype:attempted-admin; sid:92336; rev:1;)