# Signature Mints Loader

**URL:** <https://community.emergingthreats.net/t/signature-mints-loader/2075>\
**Category:** Rule Signatures\
**Created:** [October 25, 2024, 9:42am UTC](https://community.emergingthreats.net/t/signature-mints-loader/2075 "2024-10-25T09:42:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [October 25, 2024, 9:42am UTC](https://community.emergingthreats.net/t/signature-mints-loader/2075/1 "2024-10-25T09:42:59Z")

</div>

alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET MALWARE Mints.Loader GET Request”; flow:established,to\_server; content:“GET”; http\_method; content:“.php?s=mints”; http\_uri; fast\_pattern; content:“WindowsPowerShell/”; http.user\_agent; classtype:trojan-activity; reference:md5,f9b55f8eb7f2b9bc6a3fbd7e6f1db477; sid:156001; reference:url,[GitHub - cert-orangecyberdefense/mintsloader: MintsLoader IOCs](http://github.com/cert-orangecyberdefense/mintsloader); rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [October 25, 2024, 6:26pm UTC](https://community.emergingthreats.net/t/signature-mints-loader/2075/2 "2024-10-25T18:26:49Z")

</div>

hey @kevross33 thanks for the tip! We’ll get this in today’s release 🥳