alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET JA3 Hash - Possible SoftEther Windows Client SSTP Traffic"; flow:established,to_server; ja3.hash; content:"2800f914a7a4ba98aa9df62d316a460c"; reference:url,www.softether.org/4-docs/1-manual; classtype:misc-activity; sid:2068224; rev:2; metadata:affected_product SoftEther, attack_target Client_Endpoint, tls_state TLSEncrypt, created_at 2026_03_13, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_03_15, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software; target:src_ip;)