Rule History

alert http any any -> any any (msg: "ADWARE [PTsecurity] Konfety Client Registration"; flow: established, to_server; http.method; content: "GET"; http.uri; content: "/register?uid="; startswith; fast_pattern; pcre: "/^[0-9A-F]{32}-[0-9A-F]{40}$/RU"; http.header; content: "Connection|3a| keep-alive"; nocase; content: "Accept-Encoding|3a| gzip, deflate"; nocase; content: "Upgrade-Insecure-Requests|3a| 1"; nocase; content: !"Referer|3a|"; nocase; threshold: type limit, track by_src, seconds 180, count 1; reference: url, tria.ge/250830-frtyxatwgt/behavioral3; reference: url, rules.ptsecurity.com; classtype: misc-activity; sid: 10014579; rev: 2;)