alert tcp any any -> $HOME_NET any (msg:"ET HUNTING Observed Zip Slip in ZIP Archive (..\\) Inbound M2"; flow:established,to_client; file.magic; content:"Zip archive"; file.data; content:"|00 00 00 2e 2e 5c|"; fast_pattern; reference:url,security.snyk.io/research/zip-slip-vulnerability; classtype:misc-attack; sid:2064949; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_09_29, deployment Perimeter, deployment Internal, performance_impact Moderate, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_09_29, mitre_tactic_id TA0005, mitre_tactic_name Defense_Evasion, mitre_technique_id T1027, mitre_technique_name Obfuscated_Files_or_Information; target:dest_ip;)