Versions (6)
Version DetailsCurrent
Rev: 1 • Oct 9, 2025, 2:49 PMBACKDOOR [PTsecurity] SpyGlace C2 communication (APT DarkHotel)
alert http any any -> any any (msg:"BACKDOOR [PTsecurity] SpyGlace C2 communication (APT DarkHotel)"; flow:established, to_server; http.method; content:"POST"; http.uri; content:".asp"; endswith; http.header; content:"Content-Type: application/x-www-form-urlencoded|3b| charset=UTF-8"; content:!"Referer"; http.request_body; content:"b001="; startswith; content:"&b002="; distance:0; content:"&b003="; distance:0; fast_pattern; content:"&b004="; distance:0; threshold:type limit, track by_src, count 1, seconds 300; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012151; rev:1;)
Oct 9, 2025, 2:49 PM
Oct 9, 2025, 2:49 PM
Oct 16, 2025, 10:34 AM
Oct 16, 2025, 10:34 AM
rules/ptopen-malware.rules