alert http any any -> $HOME_NET [16992,16993,623,664] (msg:"ET EXPLOIT Intel AMT Login Attempt Detected (CVE 2017-5689)"; flow:to_server,established; http.header; content:"Authorization|3a 20|Digest"; content:"username=|22|"; content:"response="; fast_pattern; pcre:"/^\s*\x22{2}/R"; reference:url,mjg59.dreamwidth.org/48429.html; reference:url,www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability; reference:cve,2017-5689; classtype:attempted-admin; sid:2024287; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_05_10, cve CVE_2017_5689, deployment Internal, performance_impact Moderate, signature_severity Major, updated_at 2020_08_06;)