Ruleset Update Summary - 2023/06/29 - v10361

Ruleset Updates
1

Summary:

10 new OPEN, 10 new PRO (10 + 0)

Thanks @Fortinet, @Jane_0sint, @sekoia_io

Added rules:

Open:

  • 2046690 - ET MALWARE WinGo/PSW.Agent.DW Stealer Exfil (POST) (malware.rules)
  • 2046691 - ET MALWARE WinGo/PSW.Agent.DW Stealer CnC Response (malware.rules)
  • 2046692 - ET MALWARE JokerSpy Domain in DNS Lookup (app .influmarket .org) (malware.rules)
  • 2046693 - ET INFO External IP Address Lookup Service in DNS Lookup (getip .pro) (info.rules)
  • 2046694 - ET INFO External IP Address Lookup Service in TLS SNI (getip .pro) (info.rules)
  • 2046695 - ET MALWARE ThirdEye Stealer System Information Gathering Attempt (malware.rules)
  • 2046696 - ET MALWARE ThirdEye Stealer CnC Checkin (malware.rules)
  • 2046697 - ET MALWARE DDoSia Client CnC Checkin (malware.rules)
  • 2046698 - ET MALWARE DDoSia Client Target Retrieval (malware.rules)
  • 2046699 - ET MALWARE SocGholish Domain in DNS Lookup (editions .seattlemysterylovers .com) (malware.rules)

Modified inactive rules:

  • 2046295 - ET MALWARE Mystic Stealer C2 Session Key Response Packet (malware.rules)