ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M2

alert tls any any -> any any (
    msg:"ET HUNTING Suspicious TLS SNI Request for Possible COVID-19 Domain M2";
    flow:established,to_server;
    tls.sni;
    content:"corona"; nocase;
    content:!".jhu.edu";
    isdataat:!1,relative;
    content:!".ncsc.gov.ie";
    isdataat:!1,relative;
    content:!".nhs.wales";
    isdataat:!1,relative;
    content:!".govt.nz";
    isdataat:!1,relative;
    content:!".nhp.gov.in";
    isdataat:!1,relative;
    content:!".oracle.com";
    isdataat:!1,relative;
    content:!".cdc.gov";
    isdataat:!1,relative;
    content:!"www.coronawarn.app";
    isdataat:!1,relative;
    classtype:bad-unknown;
    sid:2029708; rev:4;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_13;
)