alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE ELF/Mirai Botnet CnC Activity"; flow:established,to_server; dsize:11; content:"SWATunknown"; fast_pattern; reference:md5,1348a00488a5b3097681b6463321d84c; reference:url,blog.netlab.360.com/threat-alert-log4j-vulnerability-has-been-adopted-by-two-linux-botnets/; classtype:command-and-control; sid:2034744; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2021_12_15, deployment Perimeter, malware_family Mirai, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_12_15;)