alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Facebook 📱 Mobile App for Android 🤖"; flow:to_server, stateless; tls_sni; content:"z-m-gateway.facebook.com"; endswith; nocase; ja3_hash; content:"87d49415a23810ab5c4b15e32cb511c2"; reference:url,https://www.facebook.com/; metadata:created_at 2025_09_21, updated_at 2025_09_21; sid:3321469; rev:1; classtype:misc-activity;)