""ET EXPLOIT Actiontec C1000A backdoor account M2""

SID: 2024980

Revision: 3

Class Type: attempted-admin

Metadata: affected_product Linux, attack_target IoT, created_at 2017_11_13, deployment Perimeter, malware_family Mirai, performance_impact Low, signature_severity Critical, updated_at 2017_11_29

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: [23,2323]

Flow: established,to_server

Contents:

• Value: "CenturyL1nk"

Within:

PCRE:

Special Options:

source