Rule History

alert http any any -> any any (msg: "REMOTE [PTsecurity] ClayRAT Checkin"; flow: established, to_server; http.method; content: "POST"; http.uri; urilen: 50; content: "/newclient?id="; startswith; content: !"&"; fast_pattern; http.header; content: !"Referer|3a|"; nocase; content: "Content-Type|3a| application/octet-stream"; nocase; http.request_body; content: !"|20|"; content: !"|00|"; bsize: >50; threshold: type limit, track by_dst, count 1, seconds 60; reference: url, tria.ge/250820-1zqaxacp2v/behavioral3; reference: url, rules.ptsecurity.com; classtype: trojan-activity; sid: 10014562; rev: 3;)