Rule History

alert tcp any any -> any any (msg: "REMOTE [PTsecurity] Crimson (APT TransparentTribe)"; flow: established, to_server; stream_size: server, <, 30; stream_size: server, >, 15; stream_size: client, <, 200; content: "|00 00 00 00|iny"; offset: 1; depth: 7; fast_pattern; content: "|3d|"; distance: 3; content: "|00 00 00 7c|"; distance: 3; content: "|7c|"; distance: 3; content: "|7c|"; distance: 0; content: "|7c|"; distance: 0; content: "|7c|"; distance: 0; reference: url, https://www.virustotal.com/gui/file/e87978f0af9bb550ab4686a7d3657e6cbfd92347744dfce8ff2321781ac2eee0/detection; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011664; rev: 2;)