alert http any any -> any any (msg:"KEYLOGGER [PTsecurity] SnakeKeylogger Exfiltration via Telegram"; flow:established, to_server; http.method; content:"POST"; http.uri; content:"/bot"; startswith; content:"/sendDocument"; distance:0; content:"Passwords"; distance:0; http.header; content:"Content-Type|3a| multipart/form-data|3b| boundary="; content:"Connection|3a| Keep-Alive"; content:!"Referer"; http.request_body; content:"PC INFO"; nocase; content:"Client Name"; distance:0; nocase; content:"IP"; distance:0; nocase; content:"Country"; distance:0; nocase; reference:url, tria.ge/250311-dxjc9ayqv7/behavioral2; reference:url, rules.ptsecurity.com; classtype:trojan-activity; sid:10013178; rev:1;)