Rule History

alert tcp any any -> any any (msg: "REMOTE [PTsecurity] Nerbian"; flow: established, to_client; stream_size: client, <, 501; stream_size: client, >, 100; stream_size: server, <, 501; stream_size: server, >, 100; content: "4r3f"; depth: 4; fast_pattern; content: "|01 00 00|"; distance: 1; within: 3; threshold: type limit, track by_src, count 1, seconds 120; reference: url, https://www.virustotal.com/gui/file/19e0aab36e15ddb57e684748ac73dbced7d08e35c5950fe53a3b4011cba1f7ac/detection; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10011998; rev: 1;)