alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Realize Operations Manager API SSRF Attempt (CVE-2021-21975)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"/casa/nodes/thumbprints"; fast_pattern; http.content_type; content:"application/json"; startswith; http.request_body; content:"|5b|"; reference:cve,2021-21975; classtype:attempted-admin; sid:2034974; rev:3; metadata:affected_product HTTP_Server, attack_target Server, tls_state TLSDecrypt, created_at 2022_01_25, cve CVE_2021_21975, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_08_28; target:dest_ip;)