Rule History

SID: 10003868 • Source: ptrules/open

Versions (6)

Version DetailsCurrent

Rev: 6 • Oct 9, 2025, 2:49 PM

Message:

REMOTE [PTsecurity] Orcus

Rule:

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"REMOTE [PTsecurity] Orcus"; flow:established, to_client; content:"|308201c730820130a00302010202|"; depth:600; content:"|164F72637573536572766572436572746966696361746530|"; within:600; fast_pattern; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10003868; rev:6;)

Created:

Oct 9, 2025, 2:49 PM

Updated:

Oct 9, 2025, 2:49 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-malware.rules