alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed KingSoft Office Domain in TLS SNI (ksord .com)"; flow:established,to_server; tls.sni; bsize:9; content:"ksord.com"; fast_pattern; reference:url,en.wikipedia.org/wiki/Kingsoft_Office_Software; classtype:misc-activity; sid:2072039; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_09_14, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag KingSoft, updated_at 2026_09_14;)