alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SERVER SLIGHTPULSE WebShell Access Inbound M1"; flow:established,to_server; http.method; content:"POST"; http.header; header_lowercase; content:"http_x_key|3a 20|BM6OAa1XCpH4x4"; fast_pattern; content:"SEnJYZXmyHhJG8JxC|0d|"; distance:1; within:18; http.header_names; to_lowercase; content:"|0d 0a|http_x_cnt|0d 0a|"; content:"|0d 0a|http_x_cmd|0d 0a|"; classtype:attempted-admin; sid:2033788; rev:3; metadata:created_at 2021_08_25, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_29;)