alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Notepad++ 🗒 on Windows 🪟"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; tls_sni; content:"notepad-plus-plus.org"; nocase; ja3.hash; content:"3b5074b1b5d032e5620f69f9f700ff0e"; reference:url,https://notepad-plus-plus.org/; metadata:created_at 2021_08_05, updated_at 2023_04_17; sid:3300767; rev:7; classtype:misc-activity;)