alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Curl User Agent 🌐 (TLS1.3 connection to FQDN)"; flow:to_server, stateless; ja3.hash; content:"0149f47eabf9a20d0893e2a44e5a6323"; fast_pattern; tls_sni; content:!"database.clamav.net"; endswith; nocase; content:!"pdfarchitect.org"; endswith; nocase; content:!"version.chamilo.org"; endswith; nocase; content:!"www.phpmyadmin.net"; endswith; nocase; content:!"services.glpi-network.com"; endswith; nocase; content:!"meta.wikimedia.org"; endswith; nocase; content:!"getcomposer.org"; endswith; nocase; content:!"pkgupdate.synology.com"; endswith; nocase; content:!"sodapdf.com"; endswith; nocase; content:!"bitdefender.com"; endswith; nocase; content:!"bitdefender.net"; endswith; nocase; content:!"update.virtualbox.org"; endswith; nocase; content:!"www.virtualbox.org"; endswith; nocase; content:!"incoming.telemetry.mozilla.org"; endswith; nocase; content:!"asustor.com"; endswith; nocase; content:!"sandboxing.stormshieldcs.eu"; endswith; nocase; content:!"entropy.ubuntu.com"; endswith; nocase; content:!"www.mageni.net"; endswith; nocase; metadata:former_category JA3; reference:url,https://curl.se/; metadata:created_at 2024_05_26, updated_at 2024_05_26; sid:3321272; rev:1; classtype:policy-violation;)