Rule History

alert http any any -> any any (msg: "BACKDOOR [PTsecurity] SpyGlace C2 communication (APT DarkHotel)"; flow: established, to_server; http.method; content: "POST"; http.uri; content: ".asp"; endswith; http.header; content: "Content-Type: application/x-www-form-urlencoded|3b| charset=UTF-8"; content: !"Referer"; http.request_body; content: "c001="; startswith; content: "&c002="; distance: 0; content: "&c003="; distance: 0; fast_pattern; content: "&c004="; distance: 0; threshold: type limit, track by_src, count 1, seconds 300; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012152; rev: 1;)