alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nexcorium Payload Retrieval Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"nexuscorp|2e|"; fast_pattern; pcre:"/^(?:arm(?:5|6|7)?|mips|mpsl|x86)$/R"; reference:url,www.fortinet.com/blog/threat-research/tracking-mirai-variant-nexcorium-a-vulnerability-driven-iot-botnet-campaign; classtype:trojan-activity; sid:2069031; rev:1; metadata:affected_product IoT, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_04_28, deployment Perimeter, malware_family Nexcorium, performance_impact Low, confidence High, signature_severity Major, updated_at 2026_04_28; target:src_ip;)