alert http any any -> any any (msg:"STEALER [PTsecurity] SHub Sending Debug Logs"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/debug/event"; endswith; fast_pattern; http.header; content:!"Referer|3a|"; nocase; http.request_body; content:"{|22|event|22 3a 22|"; startswith; pcre:"/^(?:collecting|loader|payload|data|zip)/R"; content:"|22|build_hash|22|"; within:32; content:"|22|ip|22|"; distance:0; threshold:type limit, track by_dst, count 1, seconds 120; reference:url, tria.ge/260522-g2xcfsas5x/behavioral1; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10017375; rev:1;)