alert udp $HOME_NET any -> $EXTERNAL_NET [9000] (msg:"🐾 - 🚨 Cisco Webex STUN connection"; flow:to_server, stateless; content:"|00 01|"; depth:2; content:"|21 12 a4 42|"; fast_pattern; distance:2; within:4; content:"wcb+"; pcre:"/wcb.[0-9]{10}/"; reference:url,https://www.rfc-editor.org/rfc/rfc5389; reference:url,https://en.wikipedia.org/wiki/STUN; reference:url,https://www.webex.com/; metadata:created_at 2024_05_17, updated_at 2024_05_17; sid:3321262; rev:1; classtype:policy-violation;)