Rule History

SID: 10003305 • Source: ptrules/open

Versions (7)

Version DetailsCurrent

Rev: 4 • Oct 9, 2025, 2:49 PM

Message:

SPYWARE [PTsecurity] Buhtrap

Rule:

alert smb $HOME_NET any -> $HOME_NET 445 (msg:"SPYWARE [PTsecurity] Buhtrap"; flow:established, to_server, no_stream; content:"SMB"; content:"|0B 00|"; distance:8; within:2; content:"|00 00 18 00 11 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF|"; distance:0; pcre:"/([0-9A-F]\x00){16,32}$/R"; threshold:type threshold, track by_src, count 8, seconds 2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10003305; rev:4;)

Created:

Oct 9, 2025, 2:49 PM

Updated:

Oct 9, 2025, 2:49 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-malware.rules