alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Dell KACE Remote Command Injection Inbound (CVE-2019-20504)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/krashrpt.php"; fast_pattern; http.request_body; content:"kuid="; pcre:"/^[^&]*?(?:[\x3b\x24\x26\x60\x7c]|\x25(?:25)*(?:3[bB]|2[46]|60|7[cC])|\x5c[rn])/R"; reference:url,unit42.paloaltonetworks.com/new-mirai-variant-adds-8-new-exploits-targets-additional-iot-devices/; reference:cve,2019-20504; classtype:attempted-admin; sid:2027457; rev:5; metadata:affected_product Dell, attack_target IoT, tls_state TLSDecrypt, created_at 2019_06_11, cve CVE_2019_20504, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2026_11_04, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)