ET HUNTING Possible COVID-19 Domain in SSL Certificate M1

alert tls $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET HUNTING Possible COVID-19 Domain in SSL Certificate M1";
    flow:established,to_client;
    tls.cert_subject;
    content:"corona"; nocase;
    content:!".jhu.edu";
    isdataat:!1,relative;
    content:!".ncsc.gov.ie";
    isdataat:!1,relative;
    content:!".nhs.wales";
    isdataat:!1,relative;
    content:!".govt.nz";
    isdataat:!1,relative;
    content:!".nhp.gov.in";
    isdataat:!1,relative;
    content:!".oracle.com";
    isdataat:!1,relative;
    content:!".cdc.gov";
    isdataat:!1,relative;
    content:!"CN=coronawarn.app";
    isdataat:!1,relative;
    classtype:bad-unknown;
    sid:2029705; rev:4;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_13;
)