alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Mirai Variant CnC Activity"; flow:established,from_server; dsize:9; content:"|21 2a 20 41 72 63 65 75 73|"; reference:md5,8fb3048b2aa6c63f53c031b9abd4879a; classtype:command-and-control; sid:2029913; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2020_04_15, deployment Perimeter, malware_family Mirai, confidence High, signature_severity Major, updated_at 2020_04_15, reviewed_at 2024_05_06;)