alert dns $HOME_NET any -> any any (msg:"ET INFO Observed RMM Domain in DNS Lookup (gateway .miradore .com)"; dns.query; bsize:20; content:"gateway.miradore.com"; nocase; reference:url,miradore.com/knowledge/account/firewall-openings-needed-to-manage-devices-with-miradore/; classtype:misc-activity; sid:2065124; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Mac_OSX, affected_product Android, affected_product iOS, affected_product Windows_11, affected_product Windows_8, affected_product Windows_10, affected_product Miradore, attack_target Client_and_Server, created_at 2025_10_09, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag RAT, tag RemoteAccessTool, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software;)