alert tcp any any -> $HOME_NET 873 (msg:"ET INFO Samba rsync Sender Mode Session Established"; flow:established,to_server; flowbits:set,ET.rsync.Sender; flowbits:noalert; content:"@RSYNCD|3a|"; fast_pattern; content:"--server|00|"; content:"--sender|00|"; classtype:misc-activity; sid:2067353; rev:3; metadata:created_at 2026_02_06, deployment Perimeter, deployment Internal, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_02_17;)