alert tcp any 22 -> any any (msg:"Pygmy Goat Fake SSH handshake";\
	content: "SSH-2.0-D8pjE"; offset: 0;\
	sid:1002710000; rev:1; classtype:trojan-activity;\
	metadata:date 2024-10-22;)
alert tcp any 22 -> any any (msg:"Pygmy Goat Fake SSH ed25519 key";\
	content: "|29ccf0cc16c5466e5219828e8665428c1f1ad4c3a5b1cbfcc0266c313c5c903a247de4d3576dda8ecbf466d1cb814f63fd4afa06e47e4ca09591bdcb97a4b30f|"; offset: 120;\
	sid:1002710001; rev:1; classtype:trojan-activity;\
	metadata:date 2024-10-22;)