alert http any any -> [$HOME_NET,$SMTP_SERVERS] any (msg:"ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration"; flow:established,to_server; http.uri; content:"/service/soap/BatchRequest"; fast_pattern; http.header_names; content:"x-zimbra-csrf-token|0d 0a|"; nocase; http.request_body; content:"SearchGalRequest"; content:"urn:zimbraAccount"; distance:0; content:"name|3d 22|"; distance:0; pcre:"/^[a-z0-9]{2}/R"; content:"name|3d 22|"; distance:0; pcre:"/^[a-z0-9_-]{2,5}\x22/R"; content:"name|3d 22|"; distance:0; pcre:"/^[a-z0-9_-]{2,5}\x22/R"; content:"name|3d 22|"; distance:0; pcre:"/^[a-z0-9_-]{2,5}\x22/R"; http.method; content:"POST"; threshold:type threshold,seconds 10,count 20,track by_src; reference:url,www.proofpoint.com/us/blog/threat-insight/ta488-targets-zimbra-mailservers-half-click-exploits; classtype:attempted-recon; sid:2071249; rev:1; metadata:affected_product Zimbra, attack_target SMTP_Server, created_at 2026_07_21, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, updated_at 2026_07_21; target:dest_ip;)