Snort patch based on the “tcpstatflow” tool and written to be compiled with snort-2.6.1.1 using the stream4 preprocessor. It is designed to detect traffic that is not HTTP / HTTPS / FTP / SMTP, with a reasonable margin of error.
You can download it from the following link: https://packetstormsecurity.com/files/download/52783/snort-covert.txt
Source: https://packetstormsecurity.com/files/52783/snort-covert.txt.html