Versions (7)
Version DetailsCurrent
Rev: 2 • Oct 9, 2025, 2:49 PMBACKDOOR [PTsecurity] Trojan.Backdoor (APT Patchwork)
alert http any any -> any any (msg:"BACKDOOR [PTsecurity] Trojan.Backdoor (APT Patchwork)"; flow:established, to_server; http.method; content:"POST"; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; content:!"Referer|3a|"; http.request_body; content:"umnome="; depth:7; fast_pattern; content:"&pmjodf="; distance:0; content:"&idkdfjej="; distance:0; content:"&cokenme="; distance:0; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011589; rev:2;)
Oct 9, 2025, 2:49 PM
May 13, 2026, 8:50 AM
Oct 16, 2025, 10:34 AM
May 15, 2026, 1:35 PM
rules/ptopen-malware.rules