ET ATTACK_RESPONSE MacSync Stealer Payload Inbound

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET ATTACK_RESPONSE MacSync Stealer Payload Inbound";
    flow:established,to_client;
    http.response_body;
    content:"|23 21 2f|bin|2f|zsh"; startswith;
    content:"|3d 24 28|base64|20 2d|D|20 3c 3c 27|PAYLOAD|5f|"; fast_pattern;
    content:"|7c 20|gunzip";
    classtype:trojan-activity;
    sid:2069445; rev:1;
    metadata:affected_product Mac_OSX, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_05_27, deployment Perimeter, deployment SSLDecrypt, malware_family MacSync, confidence High, signature_severity Major, updated_at 2026_05_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer;
    target:dest_ip;
)