alert http $HOME_NET any -> any any (msg:"ET INFO Plaintext SSH Private Key Outbound over HTTP"; flow:established,to_client; http.stat_code; content:"200"; http.content_type; content:"application/octet-stream"; http.response_body; content:"|20|PRIVATE|20|KEY|20|-----|0a|"; fast_pattern; isdataat:!3000; classtype:policy-violation; sid:2059889; rev:2; metadata:attack_target Server, tls_state plaintext, created_at 2025_02_05, deployment Perimeter, deployment Internal, former_category ACTIVEX, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_02_10, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery; target:src_ip;)