Summary:
8 new OPEN, 8 new PRO (8 + 0) DeimosC2, JS/Cloud9, and VBA/Agent.ADT
Thanks @Zimperium and @TrendMicro
Please share issues, feedback, and requests at Feedback
Added rules:
Open:
2039758 - ET MALWARE JS/Cloud9 Domain (download .loginserv .net) in DNS Lookup (malware.rules)
2039759 - ET MALWARE JS/Cloud9 Domain (cloud-miner .de) in DNS Lookup (malware.rules)
2039760 - ET MALWARE JS/Cloud9 Domain (zmsp .top) in DNS Lookup (malware.rules)
2039761 - ET MALWARE JS/Cloud9 Domain (download .agency) in DNS Lookup (malware.rules)
2039762 - ET MALWARE JS/Cloud9 Cookie Exfiltration Attempt (malware.rules)
2039763 - ET MALWARE JS/Cloud9 Clipboard Exfiltration Attempt (malware.rules)
2039764 - ET MALWARE DeimosC2 TCP Agent Heartbeat (malware.rules)
2039765 - ET MALWARE VBA/Agent.ADT Checkin (malware.rules)