Rule History

alert http any any -> any any (msg: "BANKER [PTsecurity] Hydra"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/api/v1/device"; http.header; content: "charset: utf-8"; nocase; http.request_body; content: "{|22|country|22|"; depth: 10; content: "|22|admin_rights_enabled|22|:"; distance: 0; fast_pattern; content: "|22|os_version|22|:"; distance: 0; content: "|22|tag|22|:"; distance: 0; content: "|22|push_token|22|:"; distance: 0; reference: url, tria.ge/240808-w3nt2a1brd/behavioral1; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012090; rev: 1;)