alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"🐾 - 🚨 Remcos RAT 🪟 (10/11) TLS connection"; flow:to_server, stateless; ja3.hash; content:"a85be79f7b569f1df5e6087b69deb493"; fast_pattern; target:src_ip; reference:url,https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos; metadata:signature_severity Major, attack_target Client_and_Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, former_category MALWARE, malware_family Remcos, created_at 2025_08_16, updated_at 2025_08_16; sid:3321457; rev:1; classtype:targeted-activity;)