# Rule Signatures **URL:** https://community.emergingthreats.net/c/rule-sigs/11.md?page=4 [Latest](https://community.emergingthreats.net/latest.md) · [Categories](https://community.emergingthreats.net/categories.md) · [Tags](https://community.emergingthreats.net/tags.md) **Page:** 5 --- ## [RadX RAT](https://community.emergingthreats.net/t/radx-rat/1316)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 2\ **Last updated:** [January 24, 2024, 11:02pm UTC](https://community.emergingthreats.net/t/radx-rat/1316 "2024-01-24T23:02:54Z")
Hi guys! Here is an article in Russian about the new malware, we already have it in the sandbox, so I propose rules for Check-In and for KeepAlive. https://www.facct.ru/blog/radx-rat/ alert http any any -\> any any (msg… --- ## [IDS and IPS rules on LAN](https://community.emergingthreats.net/t/ids-and-ips-rules-on-lan/1300)
**Author:** [@hacked](https://community.emergingthreats.net/u/hacked)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:05pm UTC](https://community.emergingthreats.net/t/ids-and-ips-rules-on-lan/1300 "2024-01-22T18:05:41Z")
Hi, I’m interesting to do IDS and IPS on the inside of my network using Suricata. I have trouble of as an exampe of detecting nmap scans and having a look at the example rule below: alert tcp $EXTERNAL\_NET any → $HOME\_… --- ## [ZharkBOT](https://community.emergingthreats.net/t/zharkbot/1305)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 2\ **Last updated:** [January 22, 2024, 4:03pm UTC](https://community.emergingthreats.net/t/zharkbot/1305 "2024-01-22T16:03:17Z")
Hello, I saw a new bot and decided to write a rule https://www.joesandbox.com/analysis/1378409/0/html alert http any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] ZharkBOT HTTP GET Request";flow: established, to\_server; … --- ## [ET Malware - Socks5Systemz](https://community.emergingthreats.net/t/et-malware-socks5systemz/1155)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 15\ **Last updated:** [January 17, 2024, 9:52pm UTC](https://community.emergingthreats.net/t/et-malware-socks5systemz/1155 "2024-01-17T21:52:46Z")
hi Team Emerging Threats can please advise where can i get more information about below rule name ET MALWARE Socks5Systemz CnC Checkin M2 need a site that can give me a deep dive into malware analysis and understandin… --- ## [RisePro TCP v.0.1](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 12\ **Last updated:** [January 10, 2024, 12:24pm UTC](https://community.emergingthreats.net/t/risepro-tcp-v-0-1/647 "2024-01-10T12:24:06Z")
Hi, it’s me again! And here’s what I brought you. Few rules for RisePro, protocol is TCP in this version instead of HTTP. Maybe it’s just a setting, I don’t know yet there is no builder. Xor encryption is the same as HTT… --- ## [Meta vs Redline Stealer](https://community.emergingthreats.net/t/meta-vs-redline-stealer/1141)
**Author:** [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\ **Replies:** 4\ **Last updated:** [January 9, 2024, 3:10pm UTC](https://community.emergingthreats.net/t/meta-vs-redline-stealer/1141 "2024-01-09T15:10:54Z")
Meta Stealer has been around since 2022 and has been used very frequently by TA in the stealers market. Somehow and because of C2 traffic similarities on Redline and Meta builds, this second has been “forget” by malware … --- ## [Further verification and vallidation](https://community.emergingthreats.net/t/further-verification-and-vallidation/1263)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 2\ **Last updated:** [January 8, 2024, 8:54pm UTC](https://community.emergingthreats.net/t/further-verification-and-vallidation/1263 "2024-01-08T20:54:40Z")
Morning team Emerging threats can please advise if there is another software that can verify and validate this below signature rule as an alert, nexsus and malware byte scans have proven futile in raising alerts of thi… --- ## [DarkCrystal RAT](https://community.emergingthreats.net/t/darkcrystal-rat/952)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 13\ **Last updated:** [January 2, 2024, 9:24pm UTC](https://community.emergingthreats.net/t/darkcrystal-rat/952 "2024-01-02T21:24:38Z")
Hello again! Our good friend James found DCrat malware traffic with a new encryption layer In turn, I quickly compared the first 344 byte check-ins and received static bytes. Probably the rule will be further clar… --- ## [Independant System Verification and Validation of Malware](https://community.emergingthreats.net/t/independant-system-verification-and-validation-of-malware/1238)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 2\ **Last updated:** [December 28, 2023, 9:32pm UTC](https://community.emergingthreats.net/t/independant-system-verification-and-validation-of-malware/1238 "2023-12-28T21:32:08Z")
hi Team Emerging Threats hope this message finds you well… can please advise why alerts on Security onion written by emerging threat does not trigger alerts on other platforms such as AV and malware byte as when i rec… --- ## [Lumma Stealer Configuration](https://community.emergingthreats.net/t/lumma-stealer-configuration/685)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 11\ **Last updated:** [December 28, 2023, 7:35pm UTC](https://community.emergingthreats.net/t/lumma-stealer-configuration/685 "2023-12-28T19:35:38Z")
Hey, I recently noticed the activity of the stealer to load the configuration. 0x20 bytes xor key AC B7 67 69 C8 D3 1A 3A E9 C4 FB 55 87 6D 49 D9 B7 73 94 69 ED E1 DE A0 0A 51 0E 4F FF CA C5 A9 The analysis was carrie… --- ## [PureLogs Stealer](https://community.emergingthreats.net/t/purelogs-stealer/1059)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 12\ **Last updated:** [December 28, 2023, 7:23pm UTC](https://community.emergingthreats.net/t/purelogs-stealer/1059 "2023-12-28T19:23:20Z")
Hi, as our collective work, I would like to present a couple of signatures for your opinion: alert tcp any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] PureLogs Stealer Exfiltration";flow: established, to\_server;content: … --- ## [StealC Stealer](https://community.emergingthreats.net/t/stealc-stealer/856)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 11\ **Last updated:** [December 28, 2023, 7:12pm UTC](https://community.emergingthreats.net/t/stealc-stealer/856 "2023-12-28T19:12:05Z")
Hello, I noticed a change in the stealer that was not yet covered by the rules. Here I propose a rule for check-in, no matter whether the server answers yes or no. Boundary features the number of bytes in hwid as well as… --- ## [DarkGate](https://community.emergingthreats.net/t/darkgate/1033)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 4\ **Last updated:** [December 28, 2023, 7:10pm UTC](https://community.emergingthreats.net/t/darkgate/1033 "2023-12-28T19:10:20Z")
Hi, having decrypted and detonated this sample that was received at the first stage of delivery, I noticed some features of http that can be used for detection. For example, the same user agent, lifetime and what is in… --- ## [Gh0stRat](https://community.emergingthreats.net/t/gh0strat/1017)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 3\ **Last updated:** [December 28, 2023, 7:06pm UTC](https://community.emergingthreats.net/t/gh0strat/1017 "2023-12-28T19:06:48Z")
Hi! We’ve got another gh0st, and here is the rule for it, built according to the template of the previous one sid:2048128 from @naumovax. alert tcp-pkt $HOME\_NET any -\> $EXTERNAL\_NET any (msg:"ET MALWARE \[ANY.RUN\] Win… --- ## [LgoogLoader, PikaBot, RedLine rules](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 7\ **Last updated:** [December 28, 2023, 7:04pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597 "2023-12-28T19:04:07Z")
Hi, today I have three rules in the ET open set. The first to load the encrypted configuration of the LgoogLoader. alert http any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] LgoogLoader";flow: established, to\_server; ht… --- ## [Inconsistency between the rules 2049660 & 2049661 and the family](https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 1\ **Last updated:** [December 19, 2023, 8:05pm UTC](https://community.emergingthreats.net/t/inconsistency-between-the-rules-2049660-2049661-and-the-family/1219 "2023-12-19T20:05:23Z")
Hi, there seems to be a little confusion with signatures 2049660 & 2049661, the fact is that it was written in RisePro because the magic and the encrypted bytes 0x36 match its traffic. Best regards, Jane ˶ᵔ ᵕ ᵔ˶ --- ## [SID 2012870 - Outbound Request contains pw](https://community.emergingthreats.net/t/sid-2012870-outbound-request-contains-pw/1218)
**Author:** [@kiwibenis](https://community.emergingthreats.net/u/kiwibenis)\ **Replies:** 2\ **Last updated:** [December 19, 2023, 6:34pm UTC](https://community.emergingthreats.net/t/sid-2012870-outbound-request-contains-pw/1218 "2023-12-19T18:34:22Z")
Hello everyone, since a few days I get alerts on this SID: 2012870 - ET POLICY HTTP Outbound Request contains pw Today the rule for me contains this: alert tcp $HOME\_NET any -\> $EXTERNAL\_NET $HTTP\_PORTS (msg:"ET POLI… --- ## [Question on 2028867](https://community.emergingthreats.net/t/question-on-2028867/1204)
**Author:** [@James\_inthe\_box](https://community.emergingthreats.net/u/James_inthe_box)\ **Replies:** 5\ **Last updated:** [December 13, 2023, 8:00pm UTC](https://community.emergingthreats.net/t/question-on-2028867/1204 "2023-12-13T20:00:05Z")
Hey all. So…java version is 11.0.18. This appears still supported? What say you? --- ## [FP: ETPRO TROJAN Possible Panda Banker DGA Lets Encrypt SSL Cert \[2825567\]](https://community.emergingthreats.net/t/fp-etpro-trojan-possible-panda-banker-dga-lets-encrypt-ssl-cert-2825567/1168)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 2\ **Last updated:** [November 29, 2023, 5:14pm UTC](https://community.emergingthreats.net/t/fp-etpro-trojan-possible-panda-banker-dga-lets-encrypt-ssl-cert-2825567/1168 "2023-11-29T17:14:24Z")
Hi, could you please revise this rule? It match certs on public tasks, making it difficult to detect phishing. Sometimes collectorstealer matches as panda. Here is submissions by tag:pandabanker :arrow\_heading\_down: … --- ## [MALWARE - classtype:misc-activity](https://community.emergingthreats.net/t/malware-classtype-misc-activity/1151)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 1\ **Last updated:** [November 27, 2023, 1:08pm UTC](https://community.emergingthreats.net/t/malware-classtype-misc-activity/1151 "2023-11-27T13:08:49Z")
Hey, I noticed a discrepancy between the class and the message: ETPRO MALWARE Agent Tesla Exfil via SMTP classtype:misc-activity; sid:2855245; former\_category MALWARE, malware\_family AgentTesla, confidence High, si… --- ## [Is bloodhound signature included in the latest weekly update](https://community.emergingthreats.net/t/is-bloodhound-signature-included-in-the-latest-weekly-update/1138)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 3\ **Last updated:** [November 23, 2023, 3:39am UTC](https://community.emergingthreats.net/t/is-bloodhound-signature-included-in-the-latest-weekly-update/1138 "2023-11-23T03:39:51Z")
hi Community just curious we have an alert of one of our security appliances on a bloodhound scanner on one of our internal client nodes i am looking after security onion ETOpen and it did not provide an alert for bloo… --- ## [SIG: W32/LitterDrifter.Loader Gamaredon USB Worm](https://community.emergingthreats.net/t/sig-w32-litterdrifter-loader-gamaredon-usb-worm/1140)
**Author:** [@kevross33](https://community.emergingthreats.net/u/kevross33)\ **Replies:** 2\ **Last updated:** [November 21, 2023, 7:14pm UTC](https://community.emergingthreats.net/t/sig-w32-litterdrifter-loader-gamaredon-usb-worm/1140 "2023-11-21T19:14:34Z")
Hi, This sig is to try and match the C2 connection based on this Malware Spotlight - Into the Trash: Analyzing LitterDrifter - Check Point Research. This is after the Telegram dead drop resolution when it connects to th… --- ## [New Sig: ET TROJAN W32/Kazuar.Backdoor Turla APT Hardcoded Cookie](https://community.emergingthreats.net/t/new-sig-et-trojan-w32-kazuar-backdoor-turla-apt-hardcoded-cookie/1136)
**Author:** [@kevross33](https://community.emergingthreats.net/u/kevross33)\ **Replies:** 1\ **Last updated:** [November 20, 2023, 10:26pm UTC](https://community.emergingthreats.net/t/new-sig-et-trojan-w32-kazuar-backdoor-turla-apt-hardcoded-cookie/1136 "2023-11-20T22:26:22Z")
Sig based on Unit42 article. HTTP POST over HTTPS with hardcoded Cookie value. alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTT\_PORTS (msg:“ET TROJAN W32/Kazuar.Backdoor Turla APT Hardcoded Cookie”; flow:established,to\_serv… --- ## [False positive on Android Trojan](https://community.emergingthreats.net/t/false-positive-on-android-trojan/1053)
**Author:** [@michmoor](https://community.emergingthreats.net/u/michmoor)\ **Replies:** 1\ **Last updated:** [October 19, 2023, 7:34pm UTC](https://community.emergingthreats.net/t/false-positive-on-android-trojan/1053 "2023-10-19T19:34:15Z")
Greetings everyone, Im writing to see what is the best way to report a false positive on a signature. Signature: ET JA3 Hash - Trojan.AndroidOS.Jocker.snt 1 Background: Seeking advice on next steps in investigation | … --- ## [2048118 is a little loose](https://community.emergingthreats.net/t/2048118-is-a-little-loose/1025)
**Author:** [@James\_inthe\_box](https://community.emergingthreats.net/u/James_inthe_box)\ **Replies:** 3\ **Last updated:** [October 12, 2023, 2:35am UTC](https://community.emergingthreats.net/t/2048118-is-a-little-loose/1025 "2023-10-12T02:35:38Z")
This is over non-standard ports…buried deep in the packet…seems a lil loose. Any anchors at all we can add? \[ 1456\] BA B7 09 CD C1 78 74 DF B3 00 95 79 2D 84 1C F0 …xt…y-… \[ 1472\] 38 32 48 B1 DC 26 E2 D5 43 35 7A DE … --- ## [Addressing an FP: 2016950 - ET MALWARE Possible Win32/Hupigon ip.txt with a Non-Mozilla UA](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003)
**Author:** [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\ **Replies:** 0\ **Last updated:** [October 2, 2023, 3:35pm UTC](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003 "2023-10-02T15:35:54Z")
A customer recently reported some False Positives on a signature and it made for an interesting case to track down. The report mentioned that 2016950 was trigging on benign HTTP traffic and was actually one of “Top 5” s… --- ## [Eternity Clipper](https://community.emergingthreats.net/t/eternity-clipper/983)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 4\ **Last updated:** [September 27, 2023, 1:07pm UTC](https://community.emergingthreats.net/t/eternity-clipper/983 "2023-09-27T13:07:08Z")
Hi! Check out new tweet on this threat ➷ And of course I propose rules for the clipper✎ alert http any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] EternityClipper (Successful Installation)";flow: established, to\_server… --- ## [NStealer v2](https://community.emergingthreats.net/t/nstealer-v2/974)
**Author:** [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\ **Replies:** 3\ **Last updated:** [September 25, 2023, 10:01pm UTC](https://community.emergingthreats.net/t/nstealer-v2/974 "2023-09-25T22:01:34Z")
A java based stealer has been spotted today over youtube compromised accounts. The log file produced by this malware was stored at Temp directory and thats how i could retrieve the name of this stealer Sandbox Detonatio… --- ## [Lumma Stealer Updates](https://community.emergingthreats.net/t/lumma-stealer-updates/946)
**Author:** [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\ **Replies:** 2\ **Last updated:** [September 15, 2023, 3:35pm UTC](https://community.emergingthreats.net/t/lumma-stealer-updates/946 "2023-09-15T15:35:20Z")
Lumma Stealer announced an update at September 14th, announcing a new exfiltration method on its builds. Endpoints /c2sock and /c2conf were changed by POST request to a common endpoint for both purposes, /api via form p… --- ## [Echida Botnet](https://community.emergingthreats.net/t/echida-botnet/918)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 3\ **Last updated:** [September 11, 2023, 8:59pm UTC](https://community.emergingthreats.net/t/echida-botnet/918 "2023-09-11T20:59:31Z")
Hi, today @ViriBack tweeted botnet echida and here I wrote a rule. alert http any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] Echida Botnet Check-In";flow: established, to\_server; http.method; content: "POST"; http.uri;… [Previous page](https://community.emergingthreats.net/c/rule-sigs/11.md?page=3) [Next page](https://community.emergingthreats.net/c/rule-sigs/11.md?page=5)