SUSPICIOUS [PTsecurity] Suspicious HTTP Header Trinper (APT Team46)

SID: 10012125Rev: 1Enabled32 views
Fileptopen-info.rules
CreatedSeptember 25, 2025
UpdatedMarch 11, 2026
Classificationmisc-activity
alert http any any -> any any (msg:"SUSPICIOUS [PTsecurity] Suspicious HTTP Header Trinper (APT Team46)"; flow:established, to_server; http.header; content:"X-Logo|3a 20|"; threshold:type limit, track by_src, count 1, seconds 300; reference:url, rules.ptsecurity.com; classtype:misc-activity; sid:10012125; rev:1;)

References

urlrules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!