alert tftp $HOME_NET any -> any any (msg:"🐾 - 💀 TFTP Zerobot 🤖 🐧 script downloading"; flow:to_server, stateless; content:"|00 01|"; content:"zero."; fast_pattern; distance:0; pcre:"/[a-z0-9]{3,}/i"; reference:url,https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities; metadata:created_at 2022_12_07, updated_at 2022_12_07; sid:3300730; rev:2; classtype:trojan-activity;)