alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ⚠ LogMeIn Agent 🎛 - Leak 🚱"; threshold:type limit, track by_src,count 1, seconds 86400; tls.cert_subject; content:"C=US"; nocase; content:"ST=Massachusetts"; nocase; content:"L=Boston"; nocase; content:"O=LogMeIn"; nocase; reference:url,https://www.logmein.com/fr; metadata:created_at 2021_07_20, updated_at 2021_09_07; sid:3300382; rev:2; classtype:policy-violation;)