alert tls any any -> any any (msg:"🐾 - 🚨 Possible Trickbot malware 👾 request"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; ja3.hash; content:"6734f37431670b3ab4292b8f60f29984"; metadata:former_category JA3; reference:url,https://github.com/salesforce/ja3; metadata:created_at 2022_02_11, updated_at 2022_08_02; sid:3300241; rev:2; classtype:trojan-activity;)