Ruleset Update Summary - 2022/12/20 - v10200

Ruleset Updates
1

Summary:

8 new OPEN, 17 new PRO (8 + 9)

Thanks @teamcymru, @Unit42_Intel

The Emerging Threats mailing list is migrating to Discourse. Please visit us at https://community.emergingthreats.net

We will announce the mailing list retirement date in the near future.

Added rules:

Open:

  • 2042969 - ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com) (info.rules)
  • 2042970 - ET PHISHING Lucy Security Phishing Server Reply (phishing.rules)
  • 2042971 - ET PHISHING Lucy Security Phishing Awareness Landing Page (phishing.rules)
  • 2042972 - ET PHISHING Lucy Security Time Tracking POST (phishing.rules)
  • 2042973 - ET MALWARE Win32/Vulturi CnC Activity (GET) (malware.rules)
  • 2042974 - ET MALWARE Charming Kitten APT Related DNS Activity (malware.rules)
  • 2042975 - ET MALWARE Gamaredon APT Related Activity (GET) (malware.rules)
  • 2042976 - ET PHISHING Lucy Security Phishing Landing Page M2 (phishing.rules)

Pro:

  • 2852961 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2022-12-20 1) (coinminer.rules)
  • 2852962 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2022-12-20 2) (coinminer.rules)
  • 2852963 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2022-12-20 3) (coinminer.rules)
  • 2852964 - ETPRO MALWARE Qbot IP Block Check - Likely Compromised Web Server (malware.rules)
  • 2852965 - ETPRO MALWARE Qbot Payload Request - Likely Compromised Web Server (malware.rules)
  • 2852968 - ETPRO MALWARE Win32/Lypserat CnC Activity (malware.rules)
  • 2852969 - ETPRO MALWARE Virus.Win32.Sality.k Checkin M2 (malware.rules)
  • 2852971 - ETPRO WEB_CLIENT Evil Keitaro Set-Cookie Inbound (a8163) (web_client.rules)
  • 2852972 - ETPRO WEB_CLIENT Evil Keitaro Set-Cookie Inbound (b15e4) (web_client.rules)

Modified active rules:

  • 2030214 - ET PHISHING Lucy Security Phishing Landing Page M1 (phishing.rules)
  • 2803502 - ETPRO MALWARE Virus.Win32.Sality.k Checkin M1 (malware.rules)
  • 2833782 - ETPRO PHISHING Successful Paypal Billing Information Phish 2018-12-03 (phishing.rules)

Removed rules:

  • 2845225 - ETPRO POLICY Observed External IP Lookup Domain in TLS SNI (api .myip .com) (policy.rules)
  • 2850868 - ETPRO MALWARE Win32/Vulturi CnC Activity (GET) (malware.rules)