Rule History

alert tcp any any -> any any (msg: "REMOTE [PTsecurity] Gh0st"; flow: established, to_server; dsize: 200<>400; stream_size: server, <, 3; content: "|a1 a6 a0|"; depth: 3; content: "|8f 90 90 ac 92 90 90 bf 84 90 90 e8 0c a9 4f d0|"; distance: 1; within: 16; reference: url, https://tria.ge/240402-bd4hzaca7x/behavioral2; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011296; rev: 2;)