redis_replication_rce.rules

alert tcp any any -> any any (msg: "ATTACK [PTsecurity] Redis Master-Slave replication RCE successful"; flow: established, to_client; content: "FULLRESYNC"; nocase; depth: 20; content: "|7F|ELF"; within: 70; reference: url, paper.seebug.org/977; reference: url, github.com/ptresearch/AttackDetection; classtype: attempted-admin; sid: 10005212; rev: 1;)