alert tls any [5986,5985,1270] -> any any (msg:"ET INFO Possible Microsoft OMI Agent Default TLS Certificate Observed"; flow:established,to_client; tls.cert_subject; content:"cloudapp.net"; tls.cert_issuer; content:".cloudapp.net"; reference:url,attackerkb.com/topics/08O94gYdF1/cve-2021-38647; reference:url,msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647; reference:url,www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution; classtype:bad-unknown; sid:2033955; rev:2; metadata:attack_target Server, created_at 2021_09_15, cve CVE_2021_38647, deployment Perimeter, deployment Internet, confidence Medium, signature_severity Informational, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_09_15;)