alert http any any -> any any (msg:"ADWARE [PTsecurity] Konfety Client Registration"; flow:established, to_server; http.method; content:"GET"; http.uri; content:"/register?uid="; startswith; fast_pattern; pcre:"/^[0-9A-F]{32}-[0-9A-F]{40}$/RU"; http.header; content:"Connection|3a| keep-alive"; nocase; content:"Accept-Encoding|3a| gzip, deflate"; nocase; content:"Upgrade-Insecure-Requests|3a| 1"; nocase; content:!"Referer|3a|"; nocase; threshold:type limit, track by_src, seconds 180, count 1; reference:url, tria.ge/250830-frtyxatwgt/behavioral3; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10014579; rev:2;)