Mystic Stealer signature

Perhaps this does not solve any of the problems listed above, but in my own style I would add a position in the stream.
First rule 2046294:
stream_size: client, =, 5;
stream_size: server,=, 1;

Second rule 2046295:
stream_size: client,=, 5;
stream_size: server, =, 257;

Yes, as I write the rules for the sandbox, such a load on the sensor is quite acceptable for us.

2 Likes