alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Xeox RMM Agent Activity"; flow:established,to_server; http.uri; content:"/xeox-agent-api/"; startswith; fast_pattern; http.host; content:"xeox.com"; endswith; reference:url,help.xeox.com/knowledge-base/gSuyNfDH6u79M82utnswf2/firewall-settings-xeox-agent-and-integrations/47T7S9tZJ2L1Z2W5gwuXoW; reference:url,dfirtnt.wordpress.com/2023/08/01/rmm-xeox-client-side-evidence/; classtype:misc-activity; sid:2068204; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Mac_OSX, affected_product Linux, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_03_13, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, tag RMM, updated_at 2026_03_13;)