Connection to Commonly Abused Free SSL Certificate Providers

network where network.protocol == "dns" and /* Add new free SSL
certificate provider domains here */ dns.question.name :
("*letsencrypt.org", "*.sslforfree.com", "*.zerossl.com",
"*.freessl.org") and /* Native Windows process paths that are
unlikely to have network connections to domains secured using free SSL
certificates */ process.executable :
("C:\\Windows\\System32\\*.exe",
"C:\\Windows\\System\\*.exe",
"C:\\Windows\\SysWOW64\\*.exe",
"C:\\Windows\\Microsoft.NET\\Framework*\\*.exe",
"C:\\Windows\\explorer.exe",
"C:\\Windows\\notepad.exe") and /* Insert noisy false positives
here */ not process.name : ("svchost.exe", "MicrosoftEdge*.exe",
"msedge.exe")