alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER DD-WRT Information Disclosure Attempt"; flow:established,to_server; flowbits:set,et.ddwrt.infodis; http.uri; content:"/Info.live.htm"; nocase; reference:url,www.exploit-db.com/exploits/15842/; classtype:attempted-recon; sid:2012116; rev:6; metadata:created_at 2010_12_30, signature_severity Major, updated_at 2020_05_04, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery;)