alert tcp $HOME_NET any -> $EXTERNAL_NET 8080: (msg:"ET COINMINER PrimeCoinMiner.Protominer"; flow:established,to_server; content:"|01 27 00 00 05 00 00 00 09|"; depth:9; content:"node"; nocase; within:4; content:"Protominer"; distance:14; within:10; reference:md5,4cab48eec2b882ec33db2e2a13ecffe6; classtype:coin-mining; sid:2018014; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_01_27, deployment Perimeter, confidence High, signature_severity Major, tag Coinminer, updated_at 2020_08_19, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)