alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Bitdefender 🇷🇴 Antivirus 🛡"; flow:to_client, established; threshold:type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Bitdefender SRL"; nocase; content:"L=Bucharest"; nocase; content:"C=RO"; nocase; content:"cdn.bitdefender.net"; fast_pattern; nocase; endswith; reference:url,https://www.bitdefender.com/; metadata:created_at 2023_04_18, updated_at 2023_04_18; sid:3300749; rev:1; classtype:misc-activity;)