ET HUNTING Possible COVID-19 Domain in SSL Certificate M2

alert tls $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET HUNTING Possible COVID-19 Domain in SSL Certificate M2";
    flow:established,to_client;
    tls.cert_subject;
    content:"covid"; nocase;
    content:!".jhu.edu";
    isdataat:!1,relative;
    content:!".ncsc.gov.ie";
    isdataat:!1,relative;
    content:!".nhs.wales";
    isdataat:!1,relative;
    content:!".govt.nz";
    isdataat:!1,relative;
    content:!".nhp.gov.in";
    isdataat:!1,relative;
    content:!".oracle.com";
    isdataat:!1,relative;
    content:!".cdc.gov";
    isdataat:!1,relative;
    content:!".canada.ca";
    isdataat:!1,relative;
    content:!"CN=*.nicovideo.jp";
    classtype:bad-unknown;
    sid:2029706; rev:5;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_08_02;
)