alert tcp-pkt $EXTERNAL_NET any -> $HOME_NET 6129 (msg:"ET INFO Dameware Mini Remote Control Session Initiation Sequence M2"; flow:established,to_server; flowbits:isset,ET.Dameware.SessionStart; dsize:40; content:"|30 11 00 00 00 00 00 00 00 00 00 00 00 00 38 40 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00|"; startswith; fast_pattern; content:"|00 00 00|"; endswith; classtype:misc-activity; sid:2068020; rev:3; metadata:affected_product DameWare, attack_target Client_and_Server, tls_state plaintext, created_at 2026_03_05, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, tag RMM, updated_at 2026_03_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software; target:dest_ip;)