alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET REMOTE_ACCESS AnyDesk Revoked Code Signing Certificate Observed"; flow:established,to_client; content:"|30 82|"; content:"|0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8|"; distance:9; within:16; fast_pattern; content:"|1e 17 0d|211213000000Z|17 0d|250108235959Z0"; distance:123; within:32; content:"philandro Software GmbH"; distance:75; within:23; reference:url,anydesk.com/en/public-statement; classtype:misc-activity; sid:2050707; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Windows_11, attack_target Client_Endpoint, created_at 2024_02_05, deployment Perimeter, deployment SSLDecrypt, former_category INFO, performance_impact Low, confidence High, signature_severity Informational, updated_at 2024_06_10; target:dest_ip;)