alert tcp [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET REMOTE_ACCESS ScreenConnect/ConnectWise Initial Checkin Packet M3"; dsize:<600; stream_size:server,<,5; content:"|87 12 10 00 00 00 00 00 00 00 00 00 00 00 00 00|"; startswith; fast_pattern; content:"|01|"; distance:7; within:1; byte_jump:1,0,relative; content:"|01|"; within:1; reference:md5,2a90199b9386d9aafbab41a7972398c9; classtype:misc-activity; sid:2048143; rev:2; metadata:attack_target Client_Endpoint, created_at 2023_09_21, deployment Perimeter, deployment Internal, former_category INFO, performance_impact Low, confidence High, signature_severity Informational, tag RemoteAccessTool, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_10, reviewed_at 2023_09_21; target:src_ip;)