Version DetailsCurrent
Rev: 3 • Oct 9, 2025, 2:49 PMREMOTE [PTsecurity] ClayRAT Checkin
alert http any any -> any any (msg:"REMOTE [PTsecurity] ClayRAT Checkin"; flow:established, to_server; http.method; content:"POST"; http.uri; urilen:50; content:"/newclient?id="; startswith; content:!"&"; fast_pattern; http.header; content:!"Referer|3a|"; nocase; content:"Content-Type|3a| application/octet-stream"; nocase; http.request_body; content:!"|20|"; content:!"|00|"; bsize:>50; threshold:type limit, track by_dst, count 1, seconds 60; reference:url, tria.ge/250820-1zqaxacp2v/behavioral3; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10014562; rev:3;)
Oct 9, 2025, 2:49 PM
Nov 21, 2025, 12:35 PM
Oct 16, 2025, 10:34 AM
Dec 4, 2025, 9:34 PM
rules/ptopen-malware.rules