alert tls any any -> any any (msg:"🐾 - 🚨 Possible Trickbot malware 👾 C2 answer"; flow:to_client, stateless; threshold:type limit, track by_src,count 1, seconds 86400; ja3s.hash; content:"623de93db17d313345d7ea481e7443cf"; metadata:former_category JA3S; reference:url,https://github.com/salesforce/ja3; metadata:created_at 2022_02_11, updated_at 2022_08_02; sid:3300242; rev:2; classtype:trojan-activity;)