THL - Naku-Pandora Mirai Operator-Bespoke CNC Protocol (Length-Prefixed String Option Keys) - Defeats Stock Mirai IDS Rules - UTA-2026-014 - Suricata Rule 1900077 (hunters-ledger)

Removed rule. This rule is known, but it is no longer present in its source. Showing the last known version.Removed: Jul 5, 2026, 4:07 AM

THL - Naku-Pandora Mirai Operator-Bespoke CNC Protocol (Length-Prefixed String Option Keys) - Defeats Stock Mirai IDS Rules - UTA-2026-014

SID: 1900077Rev: 1Enabled4 viewsHistory

Sourcehunters-ledger

Filehunters-ledger.rules

CreatedMay 26, 2026

UpdatedMay 26, 2026

alert tcp $HOME_NET any -> 165.227.175.161 23 (msg:"THL - Naku-Pandora Mirai Operator-Bespoke CNC Protocol (Length-Prefixed String Option Keys) - Defeats Stock Mirai IDS Rules - UTA-2026-014"; flow:to_server,established; dsize:>8; content:"|00 00|"; depth:2; offset:0; pcre:"/^.{4}.[\x01-\x14][A-Za-z0-9_]/"; sid:1900077; rev:1; metadata:affected_product Linux_IoT, attack_target IoT_Device, created_at 2026_05_26, deployment Perimeter, signature_severity High, tag UTA-2026-014;)

Metadata

affected productLinux_IoT

attack targetIoT_Device

created at2026_05_26

deploymentPerimeter

signature severityHigh

tagUTA-2026-014

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!