ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1

alert tls any any -> any any (
    msg:"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M1";
    flow:established,to_server;
    tls.sni;
    content:"covid"; nocase;
    content:!".jhu.edu";
    isdataat:!1,relative;
    content:!".ncsc.gov.ie";
    isdataat:!1,relative;
    content:!".nhs.wales";
    isdataat:!1,relative;
    content:!".govt.nz";
    isdataat:!1,relative;
    content:!".nhp.gov.in";
    isdataat:!1,relative;
    content:!".oracle.com";
    isdataat:!1,relative;
    content:!".cdc.gov";
    isdataat:!1,relative;
    content:!"covid19.wisc.edu";
    isdataat:!1,relative;
    content:!".canada.ca";
    isdataat:!1,relative;
    content:!".nicovideo.jp";
    isdataat:!1,relative;
    content:!"strib-covid-data.s3.amazonaws.com";
    isdataat:!1,relative;
    content:!".tousanticovid.gouv.fr";
    isdataat:!1,relative;
    classtype:bad-unknown;
    sid:2029707; rev:9;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_28;
)