alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TP-Link Archer AX21 Unauthenticated Command Injection Inbound (CVE-2023-1389)"; http.method; content:"POST"; http.uri; content:"/cgi-bin"; startswith; content:"|3b|stok=/locale?form=country"; fast_pattern; http.request_body; content:"operation=write"; content:"country=|24 28|"; reference:cve,2023-1389; reference:url,tenable.com/security/research/tra-2023-11; classtype:attempted-admin; sid:2044585; rev:1; metadata:attack_target Networking_Equipment, created_at 2023_03_14, cve CVE_2023_1389, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2023_03_14, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)