alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET RETIRED Possible KV Botnet CnC Checkin"; flow:established,to_server; dsize:42; content:"|16 00 2a 03 03|"; startswith; fast_pattern; content:"|00 20 03 03|"; distance:1; within:4; isdataat:!33,relative; reference:url,blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation; classtype:trojan-activity; sid:2049794; rev:3; metadata:affected_product Router, attack_target Networking_Equipment, created_at 2023_12_19, deployment Perimeter, former_category MALWARE, performance_impact Low, confidence Low, signature_severity Major, updated_at 2025_04_17, reviewed_at 2025_04_17; target:src_ip;)