Version DetailsCurrent
Rev: 2 • Oct 9, 2025, 2:49 PMADWARE [PTsecurity] Konfety Client Registration
alert http any any -> any any (msg:"ADWARE [PTsecurity] Konfety Client Registration"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/register?uid="; startswith; fast_pattern; pcre:"/^[0-9A-F]{32}-[0-9A-F]{40}$/RU"; http.header; content:"Connection|3a| keep-alive"; nocase; content:"Accept-Encoding|3a| gzip, deflate"; nocase; content:"Upgrade-Insecure-Requests|3a| 1"; nocase; content:!"Referer|3a|"; nocase; threshold:type limit, track by_src, seconds 180, count 1; reference:url, tria.ge/250830-frtyxatwgt/behavioral3; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014579; rev:2;)
Oct 9, 2025, 2:49 PM
May 13, 2026, 8:50 AM
Oct 16, 2025, 10:34 AM
May 15, 2026, 1:35 PM
rules/ptopen-malware.rules