Rule History

alert http any any -> any any (msg: "SPYWARE [PTsecurity] SpyNote"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/app/saveDevice"; startswith; endswith; http.header; content: "Content-Type|3a| application/x-www-form-urlencoded"; content: "User-Agent|3a| okhttp/"; content: !"Referer"; http.request_body; content: "product="; startswith; content: "&android_version="; distance: 0; content: "&deviceName="; distance: 0; content: "&model="; distance: 0; content: "&aid="; distance: 0; reference: url, tria.ge/250417-sq294swxhz/behavioral6; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10013745; rev: 1;)