ET POLICY Plaintext SSH Private Key Outbound over HTTP

alert http $HOME_NET any -> any any (
    msg:"ET POLICY Plaintext SSH Private Key Outbound over HTTP";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    http.content_type;
    content:"application/octet-stream";
    http.response_body;
    content:"|20|PRIVATE|20|KEY|20|-----|0a|"; fast_pattern;
    isdataat:!3000;
    classtype:policy-violation;
    sid:2059889; rev:1;
    metadata:attack_target Server, tls_state plaintext, created_at 2025_02_05, deployment Perimeter, deployment Internal, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_02_05, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery;
    target:src_ip;
)