[ZSCALER-ZIA] Unscannable content transferred (possible AV/sandbox evasion)

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[ZSCALER-ZIA] Unscannable content transferred (possible AV/sandbox evasion)"; program: Zscaler; json_content:".sourcetype","zscalernss-web"; json_content:".event.action","Allowed"; json_content:!".event.unscannabletype","None"; json_map: "src_ip", ".event.ClientIP"; json_map: "dest_ip", ".event.serverip"; json_map: "username", ".event.user"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype: evasion; sid:5017940; rev:2; metadata: mitre_tactic_id TA0005, mitre_technique_id T1027, created_at 2026_08_11, updated_at 2026_08_11;)