alert http $HOME_NET any -> any any (msg:"ET WEB_SPECIFIC_APPS Ivanti EPM Cloud Services Appliance Backdoor Response (CVE-2021-44529)"; flow:established,to_client; flowbits:isset,ET.CVE-2021-44529.Request; http.stat_code; content:"200"; http.response_body; content:"|3c|c123|3e|"; startswith; fast_pattern; content:"|3c 2f|c123|3e|"; distance:0; reference:url,attackerkb.com/topics/XTKrwlZd7p/cve-2021-44529; reference:cve,2021-44529; classtype:attempted-admin; sid:2059892; rev:1; metadata:affected_product Ivanti, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2025_02_05, cve CVE_2021_44529, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_02_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:src_ip;)