Rule History

alert http any any -> any any (msg: "SPYWARE [PTsecurity] Trojan.Spyware Sending info"; flow: established, to_server; http.method; content: "POST"; http.uri; content: "/app-manage?"; startswith; content: "action="; distance: 0; http.header; content: "Content-Type|3a| application/json|3b|"; nocase; content: "Accept-Encoding|3a| gzip"; nocase; content: !"Referer|3a|"; nocase; http.request_body; content: "{|22|android_id|22 3a 22|"; startswith; content: "|22|manufacturer|22 3a 22|"; distance: 0; content: "|22|model|22 3a 22|"; distance: 0; content: "|22|brand|22 3a 22|"; distance: 0; content: "|22|device|22 3a 22|"; distance: 0; content: "|22|subscriptions|22|"; distance: 0; content: "|22|carrierName|22 3a 22|"; distance: 0; fast_pattern; content: "|22|number|22 3a 22|"; distance: 0; reference: url, tria.ge/250702-1w89ls1qx7/behavioral3; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10014301; rev: 2;)