that tcp-flags match should defend agains xmas scan like flag combinations. I guess that can be dropped, as INVALID should catch those too.