Rule History

alert tcp any any -> any any (msg: "BACKDOOR [PTsecurity] ZenPak request"; flow: established, to_server; stream_size: client, >, 32; stream_size: client, <, 64; content: !"|20|"; byte_test: 1, >, 0x10, 0; byte_test: 1, <, 0x1f, 0; content: "|00 00 00|"; offset: 1; depth: 3; content: !"|00|"; within: 16; content: "|16 00 00 00|opqrs"; distance: 12; within: 31; content: !"|00|"; distance: 0; threshold: type limit, track by_dst, count 1, seconds 120; reference: url, app.any.run/tasks/d154d1eb-f4fb-4815-a9b3-b049425f08ec; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012062; rev: 3;)