Rule History

alert http any any -> any any (msg: "STEALER [PTsecurity] DuvetStealer Exfiltration"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/api/send-zip"; startswith; endswith; fast_pattern; http.header; content: "Content-Type|3a| multipart/form-data|3b| boundary=------------"; content: "User-Agent|3a| axios/"; content: "Accept-Encoding|3a| gzip, compress, deflate, br"; content: !"Referer"; http.request_body; content: "Content-Disposition|3a| form-data|3b| name=|22|file|22 3b| filename=|22|duvetstealer-"; content: "Cookies"; distance: 0; reference: url, tria.ge/250404-lgpjbstxfz/behavioral1; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10013663; rev: 1;)