alert http any any -> $HOME_NET any (msg:"ET EXPLOIT D-Link DSL-2750B - OS Command Injection"; flow:established,to_server; http.uri; content:"/login.cgi?cli="; pcre:"/^[ a-zA-Z0-9+_]*[\x27\x3b]/Ri"; reference:url,exploit-db.com/exploits/44760/; classtype:attempted-user; sid:2025756; rev:3; metadata:attack_target IoT, created_at 2018_06_27, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_08_25, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)