alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE X-Panel Payload Inbound"; flow:established,to_client; http.response_body; content:"|22|X-Panel-"; fast_pattern; pcre:"/^(?:Internal|Callback)\x22\x2c\x20?\x22\d\x22\x29[\r\n]/R"; reference:md5,77efad936a01ed754dcfeae281d7d521; classtype:trojan-activity; sid:2071958; rev:1; metadata:affected_product Windows_Client, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_09_08, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, updated_at 2026_09_08; target:dest_ip;)