Version Details
Rev: 1 • Oct 16, 2025, 3:37 PMREMOTE [PTsecurity] ClayRAT FB set clayrat_checkin
alert http any any -> any any (msg:"REMOTE [PTsecurity] ClayRAT FB set clayrat_checkin"; flow:established, to_server ; http.method; content:!"GET"; http.uri; urilen:50; content:"/newclient?id="; startswith; fast_pattern; pcre:"/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/R"; http.header; content:!"Referer|3a|"; content:"Content-Type|3a| application/x-www-form-urlencoded"; http.user_agent; content:!"Mozilla"; startswith; http.request_body; bsize:0; flowbits:set, clayrat_checkin ; flowbits:noalert; reference:url, tria.ge/250820-1zqaxacp2v/behavioral3 ; reference:url, rules.ptsecurity.com ; classtype:trojan-activity; sid:10014561; rev:1;)
Oct 16, 2025, 3:37 PM
Oct 16, 2025, 3:37 PM
Oct 17, 2025, 12:35 PM
Oct 17, 2025, 12:35 PM
Dec 4, 2025, 9:34 PM
ptopen-malware.rules