alert tcp $HOME_NET any -> $EXTERNAL_NET 15194 (msg:"ET RETIRED TheMoon CnC Checkin"; flow:established,to_server; stream_size:client,=,13; dsize:12; content:"|08 00 00 c2 5a c2 c7 8c 00 00 00 18|"; fast_pattern; reference:url,blog.lumen.com/the-darkside-of-themoon/; classtype:trojan-activity; sid:2051806; rev:3; metadata:affected_product IoT, attack_target IoT, tls_state plaintext, created_at 2024_03_26, deployment Perimeter, former_category MALWARE, malware_family TheMoon, performance_impact Low, confidence High, signature_severity Major, updated_at 2025_07_14, reviewed_at 2025_07_14; target:src_ip;)