alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"MINER [PTsecurity] RustMiner"; flow:established, to_server; content:"GET"; http_method; content:"Cache-Control: no-cache|0d 0a|Connection: Keep-Alive|0d 0a|Pragma: no-cache"; http_header; content:"Accept: */*, ???@, ??????????????"; http_header; distance:0; content:!"Referer"; http_header; threshold:type limit, track by_src, seconds 120, count 1; reference:url, https://tria.ge/240111-fj6bzaehfl/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10010726; rev:1;)