The SUPERNOVA malware disguised itself as legitimate SolarWinds traffic.

If the compromised system was a the SolarWinds monitoring server how could you distinguish legitimate traffic from illegitimate monitoring traffic?

Would signature based detection via IOCs have caught this?