[PROOFPOINT] Malware Classification Messages Delivered

alert any $HOME_NET any -> $HOME_NET any (msg:"[PROOFPOINT] Malware Classification Messages Delivered"; program:proofpoint_siem_api_data; content:"Classification
| 22 2c 22
| value
| 22 3a 20 22
| Malware"; nocase; reference:url,ptr-docs.proofpoint.com/extensibility-guides/ptr-api/?shell; reference:url,help.proofpoint.com/Threat_Insight_Dashboard/API_Documentation/SIEM_API; classtype:trojan-activity; sid:5010932; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_06, updated_at 2023_02_06, mitre_tactic_id TA0008, mitre_technique_id T1071;)