Rule History

alert http any any -> any any (msg: "LOADER [PTsecurity] SteganoAmor Operation"; flow: established, to_server; http.uri; urilen: >100; content: ".doc"; nocase; offset: 32; content: "_"; content: "/"; pcre: "/^[@\.\-a-z]{30,}[_]{2,}[@\.\-a-z]{10,}([_]{2,}[@\.\-a-z]{10,})?\.[dD][oO][cC](\?|$)/RU"; http.method; content: "GET"; http.header; content: "Accept: */*"; content: "Accept-Encoding: gzip, deflate"; content: "Connection: Keep-Alive"; content: !"Referer"; reference: url, app.any.run/tasks/aa5684e6-a51b-4667-9202-c128478db7a4; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011449; rev: 6;)