Rule History

alert http any any -> any any (msg: "TOOLS [PTsecurity] AdaptixC2 default agent activity"; flow: established, to_server; http.header.raw; content: "X-Beacon-Id|3a 20|"; nocase; http.user_agent; content: "Mozilla/5.0 (Windows NT 6.2|3b 20|rv|3a|20.0) Gecko/20121202 Firefox/20.0"; nocase; threshold: type limit, track by_src, seconds 180, count 1; reference: url, github.com/Adaptix-Framework/AdaptixC2; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10012898; rev: 1;)