Rule History

alert http any any -> any any (msg: "LOADER [PTsecurity] Trojan.Loader C2 stat Beacon (APT DarkHotel)"; flow: established, to_server; http.method; content: "GET"; http.header; content: "Referer|3a| ["; content: "] LIVE>"; fast_pattern; distance: 0; within: 10; content: ">"; distance: 0; within: 8; content: "/"; distance: 0; within: 255; content: "User-Agent|3a| Mozilla/5.0|0d0a|"; distance: 0; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012149; rev: 1;)