alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Tuya 🇨🇳 OEM Smart Home 🏠 / IoT device 🤖"; flow:to_client, established; threshold:type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Tuya Global Inc."; nocase; content:"L=San Jose"; nocase; content:"ST=California"; nocase; content:"CN=*.tuyacn.com"; fast_pattern; nocase; tls.cert_issuer; content:"O=Tuya Global Inc."; nocase; content:"L=San Jose"; nocase; content:"ST=California"; nocase; content:"CN=*.tuyacn.com"; reference:url,https://www.tuya.com/; metadata:created_at 2024_10_20, updated_at 2024_10_20; sid:3321385; rev:1; classtype:misc-activity;)