REMOTE [PTsecurity] DarkTrack

SID: 10000144Rev: 16Enabled30 views
Fileptopen-malware.rules
CreatedOctober 9, 2025
UpdatedOctober 9, 2025
Classificationtrojan-activity
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"REMOTE [PTsecurity] DarkTrack"; flow:established, to_server; flowbits:isset,PT_DarkTrack_KeepAlive; dsize:<200; content:"|ab9a 928f a383 ce83|"; fast_pattern; flowbits:unset,PT_DarkTrack_KeepAlive; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10000144; rev:16;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!