alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M2 (Group String Len 2+)"; flow:established,to_server; dsize:<34; content:"|33 66 99|"; depth:3; byte_test:1,>=,2,3; byte_test:1,<=,30,3; byte_extract:1,4,length; isdataat:!length,relative; pcre:"/^[A-Za-z0-9_-]+$/Rsi"; reference:md5,0e4c2aa30a72fd75ef49c430fd767fa0; reference:url,blog.netlab.360.com/ddos-botnet-moobot-en; classtype:command-and-control; sid:2030491; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2020_07_09, deployment Perimeter, malware_family Mirai, malware_family MooBot, confidence High, signature_severity Major, updated_at 2021_07_22;)