alert http any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"sendDocument?chat_id="; content:"Snake"; distance:0; http.request_body; content:"Snake"; content:"PC Name|3A|"; distance:0; content:"Snake Tracker"; distance:0; http.host; content:"api.telegram.org"; startswith; isdataat:!1, relative; threshold:type limit, track by_dst, count 1, seconds 120; reference:url, https://app.any.run/tasks/90f0431b-9e16-46d5-81bd-2b86645dd3a6; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10012849; rev:1;)