Versions (2)
Version DetailsCurrent
Rev: 3 • Oct 16, 2025, 3:37 PMSUSPICIOUS [PTsecurity] Possible ClayRAT Checkin
alert http any any -> any any (msg:"SUSPICIOUS [PTsecurity] Possible ClayRAT Checkin"; flow:established, to_server; http.method; content:!"GET"; http.uri; urilen:50; content:"/newclient?id="; startswith; fast_pattern; pcre:"/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/R"; http.header; content:!"Referer|3a|"; nocase; content:"Content-Type|3a| application/x-www-form-urlencoded"; nocase; http.user_agent; content:!"Mozilla"; nocase; startswith; http.request_body; bsize:0; threshold:type limit, track by_dst, count 1, seconds 60; reference:url, tria.ge/250820-1zqaxacp2v/behavioral3; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014561; rev:3;)
Oct 16, 2025, 3:37 PM
Nov 21, 2025, 12:35 PM
Oct 17, 2025, 12:35 PM
Dec 4, 2025, 9:34 PM
rules/ptopen-malware.rules