alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Microsoft Teams 📘📅📞🎥"; flow:to_client, stateless; threshold:type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"C=US"; nocase; content:"ST=WA"; nocase; content:"L=Redmond"; nocase; content:"O=Microsoft Corporation"; nocase; content:"CN=*.trouter.teams.microsoft.com"; nocase; fast_pattern; reference:url,https://www.microsoft.com/en-us/microsoft-teams/group-chat-software; metadata:created_at 2023_03_15, updated_at 2023_03_15; sid:3300813; rev:1; classtype:misc-activity;)