alert tcp $EXTERNAL_NET any -> $HOME_NET [23,2323] (msg:"ET MALWARE Possible Linux.Mirai Login Attempt (anko)"; flow:established,to_server; content:"anko|0d 0a|"; nocase; dsize:6; reference:url,krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack; classtype:attempted-admin; sid:2023436; rev:3; metadata:affected_product Linux, attack_target IoT, created_at 2016_10_26, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2024_03_07;)