alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Lenovo 💻 computer update on Windows 🪟"; flow:to_server, stateless; threshold:type limit, track by_src,count 1, seconds 86400; tls_sni; content:"filedownload.lenovo.com"; nocase; ja3.hash; content:"3b5074b1b5d032e5620f69f9f700ff0e"; reference:url,https://www.lenovo.com/; metadata:created_at 2024_08_29, updated_at 2024_08_29; sid:3321362; rev:1; classtype:misc-activity;)