Ruleset Update Summary - 2022/12/19 - v10199

Ruleset Updates
1

Summary:

10 new OPEN, 12 new PRO (10 + 2)

Thanks @ecarlesi, @James_inthe_box

The Emerging Threats mailing list is migrating to Discourse. Please visit us at https://community.emergingthreats.net

We will announce the mailing list retirement date in the near future.

Added rules:

Open:

  • 2042959 - ET MALWARE TrueBot/Silence.Downloader CnC Checkin 3 (malware.rules)
  • 2042960 - ET MALWARE TA444 Related Domain in DNS Lookup (cloudprotect .us .org) (malware.rules)
  • 2042961 - ET MALWARE TA444 Related Domain in DNS Lookup (cloud .prosec .ink) (malware.rules)
  • 2042962 - ET MALWARE Win32/Phoenix Grabber Sending System Information (POST) (malware.rules)
  • 2042963 - ET PHISHING Suncoast Credit Union Credential Phish Landing Page 2022-12-19 (phishing.rules)
  • 2042964 - ET PHISHING Possible DarkX Credential Phishing Landing Page 2022-12-19 (phishing.rules)
  • 2042965 - ET PHISHING Successful DarkX Credential Phish 2022-12-19 (phishing.rules)
  • 2042966 - ET MALWARE TA453 Related Domain in DNS Lookup (universityofmhealth .biz) (malware.rules)
  • 2042967 - ET PHISHING Successful o365 Credential Phish 2022-12-19 (phishing.rules)
  • 2042968 - ET MALWARE SocGholish Domain in DNS Lookup (navyseal .bezmail .com) (malware.rules)

Pro:

  • 2852957 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2022-12-14 1) (coinminer.rules)
  • 2852960 - ETPRO MALWARE Sylavriu.A/TorCT RAT CnC Checkin M2 (malware.rules)

Modified active rules:

  • 2816110 - ETPRO MALWARE Sylavriu.A/TorCT RAT CnC Checkin M1 (malware.rules)
  • 2852803 - ETPRO PHISHING Twitter Credential Phish Landing Page 2022-11-04 (phishing.rules)
  • 2852953 - ETPRO MALWARE Qbot Style Payload Request (malware.rules)

Disabled and modified rules:

  • 2038948 - ET MALWARE SocGholish Domain in DNS Lookup (casting .faeryfox .com) (malware.rules)
  • 2039780 - ET MALWARE SocGholish Domain in DNS Lookup (community .backpacktrader .com) (malware.rules)
  • 2039781 - ET MALWARE TA569 Domain in DNS Lookup (friscomusicgroup .com) (malware.rules)
  • 2039788 - ET MALWARE SocGholish Domain in DNS Lookup (casting .austinonline .shop) (malware.rules)
  • 2039792 - ET MALWARE SocGholish CnC Domain in DNS Lookup (diary .lojjh .com) (malware.rules)
  • 2039798 - ET MALWARE SocGholish Domain in DNS Lookup (factors .djbel .com) (malware.rules)

Removed rules:

  • 2834446 - ETPRO MALWARE TrueBot/Silence.Downloader CnC Checkin 3 (malware.rules)
  • 2851990 - ETPRO MALWARE TA453 Related Domain in DNS Lookup (malware.rules)