alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Mirai Variant Checkin Response"; flow:established,to_client; content:"|21 2a 20|LOLNOBYE"; endswith; reference:url,www.stratosphereips.org/blog/2019/5/17/iot-malware-analysis-series-a-mirai-variant-in-ctu-iot-malware-capture-49-1; classtype:command-and-control; sid:2027366; rev:2; metadata:affected_product Linux, attack_target IoT, created_at 2019_05_20, deployment Perimeter, malware_family Mirai, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_09_28;)