alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Automox RMM Installer Downloaded From 3rd Party"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"Automox_Installer"; fast_pattern; content:".msi"; endswith; http.host; content:!"automox.com"; endswith; classtype:misc-activity; sid:2070042; rev:1; metadata:affected_product Windows_Client, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_23, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, tag RMM, updated_at 2026_06_23, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1036, mitre_technique_name Masquerading; target:src_ip;)