ET POLICY Observed SSL Cert (Pastebin-style Service nrecom)

alert tls $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET POLICY Observed SSL Cert (Pastebin-style Service nrecom)";
    flow:from_server,established;
    tls.cert_subject;
    content:"CN=ngn.gg"; nocase; fast_pattern; endswith;
    tls.cert_issuer;
    content:"C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3";
    classtype:policy-violation;
    sid:2031000; rev:1;
    metadata:created_at 2020_10_12, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_12;
)