Rule History

alert http any any -> any any (msg: "KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "sendDocument?chat_id="; content: "Snake"; distance: 0; http.request_body; content: "Snake"; content: "PC Name|3A|"; distance: 0; content: "Snake Tracker"; distance: 0; http.host; content: "api.telegram.org"; startswith; isdataat: !1, relative; threshold: type limit, track by_dst, count 1, seconds 120; reference: url, https://app.any.run/tasks/90f0431b-9e16-46d5-81bd-2b86645dd3a6; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10012849; rev: 1;)