REMOTE [PTsecurity] DarkTrack FB set PT_DarkTrack_KeepAlive

SID: 10000143Rev: 1728 views
History
Sourceptrules/open
CreatedOctober 9, 2025
UpdatedOctober 9, 2025
Classificationtrojan-activity
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"REMOTE [PTsecurity] DarkTrack FB set PT_DarkTrack_KeepAlive"; flow:established, to_server; dsize:6; byte_test:1,>,0,1; content:"|00 00 00 01|"; distance:2; within:4; fast_pattern; flowbits:set,PT_DarkTrack_KeepAlive; flowbits:noalert; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10000143; rev:17;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!