drop tls $HOME_NET any -> $EXTERNAL_NET any (msg:"JADEPROX TLS SNI to known IOC domain"; flow:established,to_server; tls.sni; pcre:"/(^|\.)(sylverixstrategy\.com|gouvvbo\.top|claude-pro\.com|vertextrust-advisors\.com|update-trellix\.com|update-crowdstrike\.com|update-sentinelone\.com)$/i"; classtype:trojan-activity; sid:9902003; rev:1;)