alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Notepad++ 🗒 on Linux Wine 🍷🐧"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; tls_sni; content:"notepad-plus-plus.org"; nocase; ja3.hash; content:"a35a8948ef1262d99ac83ac1a61a40fd"; reference:url,https://notepad-plus-plus.org/; metadata:created_at 2023_04_17, updated_at 2023_04_17; sid:3300768; rev:1; classtype:misc-activity;)