alert tcp any any -> any 22 (msg:"🐾 - OpenSSH 5.3 P1"; flow:to_server, stateless; flowbits:set,pptrls.pygmygoatfakessh; flowbits:isnotset,pptrls.pygmygoatfakessh; content:"|53 53 48 2d 32 2e 30 2d 4f 70 65 6e 53 53 48 5f 35 2e 33 70 31 0d 0a|"; fast_pattern; metadata:created_at 2024_11_12, updated_at 2024_11_12; sid:3321402; rev:1; classtype:not-suspicious; noalert;)