alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO ScreenConnect Initial Origin Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:24; content:"/InstallerOriginInfo.axd"; fast_pattern; http.host; content:"check.screenconnect.com"; classtype:misc-activity; sid:2071164; rev:1; metadata:affected_product ScreenConnect, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_07_13, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag RMM, updated_at 2026_07_13; target:src_ip;)