Rule History

SID: 10011739 • Source: ptrules/open

Versions (6)

Version DetailsCurrent

Rev: 2 • Oct 9, 2025, 2:49 PM

Message:

STEALER [PTsecurity] EncryptHub

Rule:

alert http any any -> any any (msg:"STEALER [PTsecurity] EncryptHub"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/main/tgreport/tgmes.ps1"; depth:24; http.user_agent; content:"WindowsPowerShell/"; reference:url, www.virustotal.com/gui/file/60959a8e3fa1bcd054f005b3ec3cd591675f9b8f8f7c11ba39d309184bd20f8c/; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10011739; rev:2;)

Created:

Oct 9, 2025, 2:49 PM

Updated:

Oct 9, 2025, 2:49 PM

DB Created:

Oct 16, 2025, 10:34 AM

DB Updated:

Oct 16, 2025, 10:34 AM

Filename:

rules/ptopen-malware.rules