Ruleset Update Summary - 2023/06/14 - v10348

Ruleset Updates
1

Summary:

10 new OPEN, 10 new PRO (10 + 0)

Thanks @RexorVc0, @Jane_0sint

Added rules:

Open:

  • 2046263 - ET MALWARE APT-C-36 Related Domain in DNS Lookup (travel-ag .com) (malware.rules)
  • 2046264 - ET HUNTING DropBox User Content Download for payload.bin (hunting.rules)
  • 2046265 - ET MALWARE DoubleFinger Domain in DNS Lookup (cryptohedgefund .us) (malware.rules)
  • 2046266 - ET MALWARE [ANY.RUN] RisePro TCP v.0.1 (Token) (malware.rules)
  • 2046267 - ET MALWARE [ANY.RUN] RisePro TCP v.0.1 (External IP) (malware.rules)
  • 2046268 - ET MALWARE [ANY.RUN] RisePro TCP v.0.1 (Get_settings) (malware.rules)
  • 2046269 - ET MALWARE [ANY.RUN] RisePro TCP v.0.1 (Activity) (malware.rules)
  • 2046270 - ET MALWARE [ANY.RUN] RisePro TCP v.0.1 (Exfiltration) (malware.rules)
  • 2046271 - ET MALWARE SocGholish Domain in DNS Lookup (toolkit .mobileautorepairmechanic .com) (malware.rules)
  • 2046272 - ET MALWARE SocGholish Domain in DNS Lookup (webdog .ilinkads .com) (malware.rules)

Modified inactive rules:

  • 2836743 - ETPRO MALWARE MuddyWater PowerShell RAT Check-in (malware.rules)
1 Like