alert tcp any any -> $HOME_NET 5038 (msg:"ET EXPLOIT Sangoma Asterisk Originate AMI RCE (CVE-2019-18610) (PoC Based)"; flow:established,to_server; content:"action|3a 20|originate"; nocase; fast_pattern; content:"application|3a 20|originate"; nocase; content:"data|3a 20|"; nocase; content:"|2c|app|2c|system|2c|"; nocase; within:200; reference:cve,2019-18610; reference:url,issues-archive.asterisk.org/ASTERISK-28580; classtype:attempted-admin; sid:2035014; rev:3; metadata:affected_product Asterisk, attack_target Networking_Equipment, created_at 2022_01_28, cve CVE_2019_18610, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_08_20; target:dest_ip;)