alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"THL ShinyHunters DLS - TLS SNI shinyhunte.rs"; flow:established,to_server; tls.sni; content:"shinyhunte.rs"; endswith; nocase; classtype:trojan-activity; sid:1900089; rev:1; metadata:author "The Hunters Ledger", reference https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/, created_at 2026-04-17, attack_target Client_Endpoint, mitre_tactic_id TA0011, mitre_technique_id T1583.001;)