Rule History

alert http any any -> any any (msg: "BANKER [PTsecurity] Hydra"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/api/v1/device/update"; http.header; content: "charset: utf-8"; nocase; http.request_body; content: "{|22|bot_phones|22|:"; depth: 14; fast_pattern; reference: url, tria.ge/240808-w3nt2a1brd/behavioral1; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012079; rev: 1;)