alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SSL/TLS Certificate Observed (FIN7 JSSLoader)"; flow:established,to_client; tls.cert_subject; content:"CN=divorceradio.com"; bsize:19; fast_pattern; reference:url,www.mandiant.com/resources/evolution-of-fin7; reference:md5,3985b60c6aba7cb38998e3f898fba79a; classtype:trojan-activity; sid:2035755; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_04_05, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_14;)