alert udp $HOME_NET any -> ![20.192.0.0/10,52.96.0.0/12,137.117.0.0/16,51.103.0.0/16,51.104.0.0/16,51.105.0.0/16,52.112.0.0/14,52.96.0.0/12,130.61.0.0/16,3.0.0.0/9,100.64.0.0/10,$HOME_NET] [1023:] (msg:"🐾 - 🚨 Microsoft Teams - client for Windows 🪟 - P2P direct Calling via STUN connection"; flow:to_server, stateless; content:"|00 01|"; depth:2; content:"|21 12 a4 42|"; distance:2; within:4; content:"|00 06 00 09|"; pcre:"/....:..../"; content:"|80|"; content:"|00 08|"; distance:1; content:"|80 70 00 04 00 00 00 07 80 36|"; fast_pattern; distance:8; content:"|00 04 6e ff|"; distance:8; content:"|80 37 00 04 00 00 00|"; distance:2; reference:url,https://www.rfc-editor.org/rfc/rfc5389; reference:url,https://en.wikipedia.org/wiki/STUN; reference:url,https://www.microsoft.com/en-us/microsoft-teams/group-chat-software; metadata:created_at 2022_12_07, updated_at 2024_02_28; sid:3300158; rev:21; classtype:policy-violation;)