alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux DDoS bot Antiq IRC"; flow:established,to_server; content:"PRIVMSG|20|#"; content:"status checking progam online"; within:60; reference:url,deependresearch.org/2014/07/another-linux-ddos-bot-via-cve-2012-1823.html; classtype:trojan-activity; sid:2018675; rev:1; metadata:created_at 2014_07_14, signature_severity Major, updated_at 2019_07_26;)