Rule History

alert http any any -> any any (msg: "BANKER [PTsecurity] Trojan.Banker"; flow: established, to_server; http.method; content: "POST"; http.uri; content: ".php"; http.header; content: "Content-Type: application/x-www-form-urlencoded"; content: "Accept: text/html, */*"; content: !"Referer"; http.request_body; content: "titulo="; depth: 7; nocase; content: "&texto="; distance: 0; within: 100; nocase; content: "Mac"; distance: 0; nocase; content: "Resolucao"; distance: 0; nocase; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011254; rev: 1;)