TOOLS [PTsecurity] Sliver C2 HTTP Key exchange (Base64 modified alphabet)

SID: 10015574Rev: 15 views
Sourceptrules/open
CreatedNovember 11, 2025
UpdatedNovember 11, 2025
Classificationattempted-admin
alert http any any -> any any (msg:"TOOLS [PTsecurity] Sliver C2 HTTP Key exchange (Base64 modified alphabet)"; flow:established, to_server; http.method; content:"POST"; http.uri; pcre:"/\?(?:[a-z_]=[a-z0-9_]{7,14}&[a-z_]{2}=[a-z0-9_]{8,13}|[a-z_]{2}=[a-z0-9_]{8,13}&[a-z_]=[a-z0-9_]{7,14}|[a-z_]=[a-z0-9_]{7,14})$/U"; http.header.raw; content:!"Cookie|3a|"; nocase; content:"Accept-Encoding|3A| gzip|0d 0a|"; nocase; http.request_body; content:"_"; content:"-"; content:"+"; bsize:142; pcre:"/(?:^[a-fh-zA-Z0-9_\-\+]+$)/P"; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10015574; rev:1;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!