Back to Rule

Rule History

SID: 10012279 • Source: ptrules/open

Versions (6)

Version DetailsCurrent

Rev: 2Sep 4, 2025, 8:46 AM

TOOLS [PTsecurity] Sliver C2 HTTP Key exchange (PNG)

alert http any any -> any any (msg:"TOOLS [PTsecurity] Sliver C2 HTTP Key exchange (PNG)"; flow:established, to_server; http.method; content:"POST"; http.uri; pcre:"/\?(?:[a-z_]=[a-z0-9_]{7,14}&[a-z_]{2}=[a-z0-9_]{8,13}|[a-z_]{2}=[a-z0-9_]{8,13}&[a-z_]=[a-z0-9_]{7,14}|[a-z_]=[a-z0-9_]{7,14})$/U"; http.header.raw; content:!"Cookie|3a|"; nocase; content:"Accept-Encoding|3A| gzip|0d 0a|"; nocase; http.request_body; content:"|89|PNG|0D 0A 1A 0A|"; fast_pattern; depth:8; reference:url, sliver.sh/docs?name=HTTPS+C2; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10012279; rev:2;)

Sep 4, 2025, 8:46 AM

Sep 4, 2025, 8:46 AM

Oct 16, 2025, 10:34 AM

Oct 16, 2025, 10:34 AM

rules/ptopen-tools.rules