alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Lenovo 💻 computer update on Windows 🪟"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; tls_sni; content:"filedownload.lenovo.com"; nocase; ja3.hash; content:"54328bd36c14bd82ddaa0c04b25ed9ad"; reference:url,https://www.lenovo.com/; metadata:created_at 2022_02_14, updated_at 2024_08_29; sid:3300786; rev:3; classtype:misc-activity;)