alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed RMM Domain (swi-dre .com) in TLS SNI"; flow:established,to_server; tls.sni; dotprefix; content:".swi-dre.com"; endswith; fast_pattern; reference:url,solarwindscore.my.site.com/SuccessCenter/s/article/Ports-and-Domains-Firewall-and-AV-Exclusions-in-DRE?language=en_US; classtype:misc-activity; sid:2067964; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2026_03_02, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag RMM, updated_at 2026_03_02, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software;)