Rule History

alert http any any -> any any (msg: "TOOLS [PTsecurity] Sliver C2 HTTP Key exchange (hex)"; flow: established, to_server; http.method; content: "POST"; http.uri; pcre: "/\?(?:[a-z_]=[a-z0-9_]{7,14}&[a-z_]{2}=[a-z0-9_]{8,13}|[a-z_]{2}=[a-z0-9_]{8,13}&[a-z_]=[a-z0-9_]{7,14}|[a-z_]=[a-z0-9_]{7,14})$/U"; http.header.raw; content: !"Cookie|3a|"; nocase; content: "Accept-Encoding|3A| gzip|0d 0a|"; nocase; http.request_body; bsize: 211<>533; pcre: "/^[a-f0-9]+$/P"; reference: url, virustotal.com/gui/file/e877e29e45b823fe32c600508dd9e05e399272c98449976b66f44721e54e42e3/detection; reference: url, github.com/BishopFox/sliver; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10008541; rev: 5;)