alert tls $EXTERNAL_NET 853 -> $HOME_NET any (msg:"ET POLICY Quad9 DNS Over TLS Certificate Inbound"; flow:established,to_client; tls.cert_subject; content:"C=US, ST=California, L=Berkeley, O=Quad9, CN=*.quad9.net"; endswith; fast_pattern; reference:md5,1e686b56ccbcb28667698389703bb13a; classtype:policy-violation; sid:2027918; rev:3; metadata:attack_target Client_Endpoint, created_at 2019_08_26, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, updated_at 2020_09_17;)