alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - 🚨 Fake GMail TLS Certificate"; flow:to_client, stateless; tls.cert_subject; content:"CN=gmail.com"; content:"O=Google GMail"; fast_pattern; tls.cert_issuer; content:"O=Google GMail"; reference:url,https://thedfirreport.com/2022/04/25/quantum-ransomware/; metadata:created_at 2022_06_28, updated_at 2022_12_04; sid:3300687; rev:2; classtype:trojan-activity;)