alert tcp $EXTERNAL_NET !443 -> $HOME_NET any (msg:"ET MALWARE ELF/MooBot Mirai DDoS Variant Server Response"; flow:established,to_client; dsize:3; content:"|33 66 99|"; reference:md5,0e4c2aa30a72fd75ef49c430fd767fa0; reference:url,blog.netlab.360.com/ddos-botnet-moobot-en; classtype:command-and-control; sid:2030489; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2020_07_09, deployment Perimeter, malware_family Mirai, malware_family MooBot, confidence High, signature_severity Major, updated_at 2021_09_02;)