alert udp $HOME_NET any -> [130.61.0.0/16,3.0.0.0/9] [1023:] (msg:"🐾 - 🚨 Possible GoTo Connect Calling via STUN connection"; flow:to_server, stateless; content:"|00 01|"; depth:2; content:"|21 12 a4 42|"; distance:2; within:4; content:"|00 06 00 09|"; pcre:"/....:..../"; content:"|c0 57 00 04|"; fast_pattern; content:"|80|"; distance:4; content:"|00 08|"; distance:1; reference:url,https://www.rfc-editor.org/rfc/rfc5389; reference:url,https://en.wikipedia.org/wiki/STUN; reference:url,https://www.goto.com/fr/connect; metadata:created_at 2023_06_29, updated_at 2023_06_29; sid:3300160; rev:1; classtype:policy-violation;)