alert tcp any any -> $HOME_NET any (msg:"ET HUNTING Observed Zip Slip in TAR Archive (../) Inbound M1"; flow:established,to_client; file.magic; content:"POSIX tar archive"; file.data; content:"|00 00 00 2e 2e 2f|"; fast_pattern; reference:url,security.snyk.io/research/zip-slip-vulnerability; classtype:misc-attack; sid:2064946; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_09_29, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_29, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1027, mitre_technique_name Obfuscated_Files_or_Information; target:dest_ip;)