Rule History

SID: 10003309 • Source: ptrules/open

Versions (7)

Version DetailsCurrent

Rev: 3 • Oct 9, 2025, 2:49 PM

Message:

SPYWARE [PTsecurity] Buhtrap

Rule:

alert smb $HOME_NET any -> $HOME_NET 445 (msg: "SPYWARE [PTsecurity] Buhtrap"; flow: established, to_server, no_stream; content: "SMB"; content: "|05 00|"; distance: 8; within: 2; content: ".|00|e|00|x|00|e|00|"; nocase; distance: 96; pcre: "/([0-9A-F]\x00){8,15}\x2e\x00e\x00x\x00e\x00/"; flowbits: isset, Pegasus.arch_probe; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10003309; rev: 3;)

Created:

Oct 9, 2025, 2:49 PM

Updated:

Oct 9, 2025, 2:49 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-malware.rules