Rule History

SID: 10002269 • Source: ptrules/open

Versions (6)

Version DetailsCurrent

Rev: 7 • Sep 4, 2025, 8:46 AM

Message:

TOOLS [PTsecurity] Empire

Rule:

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"TOOLS [PTsecurity] Empire"; flow:established, to_client; content:"200"; http_stat_code; content:"If($PSVersionTable.PSVersion.Major -ge 3){"; http_server_body; nocase; depth:1000; content:"$GPS=[ref].Assembly.GetType("; http_server_body; nocase; within:100; content:"System.Management.Automation.Utils"; http_server_body; within:100; reference:url, https://www.hybrid-analysis.com/sample/cbf244479304572782de8ab375671da632012777c7bcf0b0e252958bff03dca4/?environmentId=100; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10002269; rev:7;)

Created:

Sep 4, 2025, 8:46 AM

Updated:

Sep 4, 2025, 8:46 AM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-tools.rules