alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ F-Secure 🇫🇮 Antivirus 🛡"; flow:to_client, established; threshold:type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=F-Secure Corporation"; nocase; content:"L=Helsinki"; nocase; content:"C=FI"; nocase; content:"CN=doorman.sp.f-secure.com"; nocase; fast_pattern; reference:url,https://www.f-secure.com/; metadata:created_at 2021_07_14, updated_at 2023_12_27; sid:3300742; rev:8; classtype:misc-activity;)