Rule History

alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg: "SPYWARE [PTsecurity] Buhtrap"; flow: established, to_server; content: "POST"; http_method; content: ".php"; http_uri; content: "Content-Type: multipart/form-data|3b| boundary="; http_header; pcre: "/^[0-9a-f]{12}\r\n/RH"; content: "Content-Type: application/octet-stream"; http_client_body; content: "Content-Disposition: form-data|3b| name=|22|"; http_client_body; pcre: "/^[a-z]{8,14}\x22\r\nContent-Type: application/octet-stream\r\n\r\n(.{192}){1,2}\r\n--[0-9a-z]{12}--/RPs"; pcre: "/[\x0e-\x19\x80-\xff]{4}/P"; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10003298; rev: 4;)