ET PHISHING Request for Possible Microsoft Phishing Hosted on Github.io

alert tls $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET PHISHING Request for Possible Microsoft Phishing Hosted on Github.io";
    flow:established,to_server;
    tls.sni;
    content:"microsoft";
    content:".github.io"; endswith; fast_pattern;
    content:!"microsoft.github.io"; depth:19; endswith;
    content:!"microsoftedge.github.io"; depth:23; endswith;
    classtype:policy-violation;
    sid:2027274; rev:5;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_04_23, deployment Perimeter, confidence Medium, signature_severity Minor, tag Phishing, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_08_06;
)