alert tls $EXTERNAL_NET any -> $HOME_NET any (msg: "SSLBL: Malicious SSL certificate detected (Rhadamanthys C&C)"; tls_cert_fingerprint; content: "3c:4c:19:6b:0a:a2:08:97:4a:dd:3b:d4:c2:88:43:1c:b3:f2:b8:33"; reference: url, sslbl.abuse.ch/ssl-certificates/sha1/3c4c196b0aa208974add3bd4c288431cb3f2b833/; sid: 903206715; rev: 1;)