alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Microsoft Office 365 📘"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; tls_sni; content:"ocws.officeapps.live.com"; nocase; ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; reference:url,https://www.office.com/; metadata:created_at 2022_07_22, updated_at 2022_08_09; sid:3300804; rev:2; classtype:misc-activity;)