Version Details
Rev: 2 • Nov 28, 2024, 12:14 PMSUSPICIOUS [PTsecurity] Possible SteganoAmor Operation
alert http any any -> any any (msg:"SUSPICIOUS [PTsecurity] Possible SteganoAmor Operation"; flow:established, to_server ; http.uri; urilen:>100; content:".doc"; nocase; endswith; content:"_"; content:"/"; pcre:"/^[a-z]{40,}[_]{2,}[a-z]{10,}([_]{2,}[a-z]{10,})?\.[dD][oO][cC]$/RU" ; http.method; content:"GET"; http.header; content:"Accept: */*" ; content:"Accept-Encoding: gzip, deflate" ; content:"Connection: Keep-Alive" ; content:!"Referer"; reference:url, https://app.any.run/tasks/aa5684e6-a51b-4667-9202-c128478db7a4 ; reference:url, rules.ptsecurity.com ; classtype:misc-activity; sid:10011449; rev:2;)
Nov 28, 2024, 12:14 PM
Nov 28, 2024, 12:14 PM
Dec 3, 2024, 4:43 PM
Dec 3, 2024, 4:43 PM
May 30, 2025, 5:56 PM