alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET JA3 Hash - Possible SoftEther Server-Side Traffic"; flow:established,to_server; ja3.hash; content:"1ab137dee39c7e6f845078cdc8b5b764"; reference:url,www.softether.org/4-docs/1-manual; classtype:misc-activity; sid:2068223; rev:1; metadata:affected_product SoftEther, attack_target Server, tls_state TLSEncrypt, created_at 2026_03_13, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Informational, updated_at 2026_03_13, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software; target:src_ip;)