Rule History

alert http any any -> any any (msg: "BACKDOOR [PTsecurity] RustyNet (APT Patchwork)"; flow: established, to_server; http.method; content: "POST"; http.uri; content: ".php"; endswith; http.header; content: "Content-Type: application/x-www-form-urlencoded"; content: !"Referer"; http.request_body; content: "uuiddsd="; depth: 8; fast_pattern; content: "&uqid="; distance: 0; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011590; rev: 1;)