""ET TROJAN Possible Linux.Mirai DaHua Default Credentials Login""

SID: 2023674

Revision: 1

Class Type: attempted-admin

Metadata: attack_target IoT, created_at 2016_12_20, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2016_12_20

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: [6789]

Flow: to_server,established

Contents:

  • Value: "888888|0d 0a|888888" Depth: 14

  • Value: "busybox telnetd -p"

Within:

PCRE:

Special Options:

source