Rule History

SID: 10012139 • Source: ptrules/open

Versions (3)

Rev: 2

Mar 2, 2026, 1:34 PM

Current

Rev: 2

Oct 16, 2025, 10:34 AM

Version Details

Rev: 1 • Nov 28, 2024, 12:14 PM

Message:

KEYLOGGER [PTsecurity] SnakeKeylogger exfiltration via Telegram

Rule:

alert http any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger exfiltration via Telegram"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/bot/sendMessage?chat_id="; startswith; content:"&text="; distance:0; content:"PC Name|3a|"; within:16; fast_pattern; content:"Country Name|3a|"; distance:0; content:"Clicked on the File"; distance:0; http.host; content:"api.telegram.org"; startswith; isdataat:!1, relative; threshold:type limit, track by_dst, count 1, seconds 120; reference:url, https://www.virustotal.com/gui/file/bcade8f76366bc86315e2775770083a82a5f1ca9344d03be5ef52616dcceaea8/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012139; rev:1;)

Created:

Nov 28, 2024, 12:14 PM

Updated:

Nov 28, 2024, 12:14 PM

DB Created:

Dec 3, 2024, 4:43 PM

DB Updated:

Dec 3, 2024, 4:43 PM

Archived:

May 30, 2025, 5:56 PM