alert http any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/sendMessage?chat_id="; content:"&text="; distance:0; content:"PC Name|3a|"; within:16; fast_pattern; content:"Country Name|3a|"; distance:0; content:"Clicked on the File"; distance:0; http.host; content:"api.telegram.org"; startswith; isdataat:!1, relative; threshold:type limit, track by_dst, count 1, seconds 120; reference:url, https://www.virustotal.com/gui/file/bcade8f76366bc86315e2775770083a82a5f1ca9344d03be5ef52616dcceaea8/detection; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012139; rev:2;)