alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Curl User Agent 🌐 (Windows 🪟 TLS1.2)"; flow:to_server, stateless; ja3.hash; content:"74954a0c86284d0d6e1c4efefe92b521"; fast_pattern; tls_sni; content:!"cdn.bitdefender.net"; endswith; nocase; content:!"avast.com"; endswith; nocase; content:!"onestart.ai"; endswith; nocase; metadata:former_category JA3; reference:url,https://curl.se/; metadata:created_at 2023_04_18, updated_at 2025_03_14; sid:3300199; rev:3; classtype:policy-violation;)