alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SSLBL: Malicious SSL certificate detected (OffLoader C&C)"; tls_cert_fingerprint; content: "4d:cf:18:f3:e3:db:29:99:96:c9:7e:01:6e:bd:b1:8a:1f:33:a4:b5"; reference: url, sslbl.abuse.ch/ssl-certificates/sha1/4dcf18f3e3db299996c97e016ebdb18a1f33a4b5/; sid: 903206711; rev: 1;)