Ruleset Update Summary - 2023/06/30 - v10362

Ruleset Updates
1

Summary:

16 new OPEN, 17 new PRO (16 + 1)

Thanks @Jane_0sint, @malwrhunterteam, @StopMalvertisin

Added rules:

Open:

  • 2046700 - ET INFO DERO Crypto Mining Related Domain in DNS Lookup (info.rules)
  • 2046701 - ET MALWARE Gamaredon APT Related CnC Activity (POST) M3 (malware.rules)
  • 2046702 - ET COINMINER Win32/Repl_it Coin Miner CnC Checkin (coinminer.rules)
  • 2046703 - ET COINMINER Win32/Duino-Coin Miner CnC Checkin (coinminer.rules)
  • 2046704 - ET MALWARE Observed Trojan.Boxter/winlnk Domain (arm .texchi .xyz in TLS SNI) (malware.rules)
  • 2046705 - ET MALWARE TA444 Domain in DNS Lookup (docsend .linkpc .net) (malware.rules)
  • 2046706 - ET MALWARE TA444 Domain in DNS Lookup (jaicvc .com) (malware.rules)
  • 2046707 - ET MALWARE Observed TA444 Domain in TLS SNI (jaicvc .com) (malware.rules)
  • 2046708 - ET MALWARE Observed TA444 Domain in TLS SNI (docsend .linkpc .net) (malware.rules)
  • 2046709 - ET MALWARE JokerSpy Domain in DNS Lookup (git-hub .me) (malware.rules)
  • 2046710 - ET MALWARE Observed JokerSpy Domain (git-hub .me in TLS SNI) (malware.rules)
  • 2046711 - ET MALWARE RedLine Stealer Domain in DNS Lookup (nordvpn-media .com) (malware.rules)
  • 2046712 - ET MALWARE TA444 Related Domain in DNS Lookup (crypto .hondchain .com) (malware.rules)
  • 2046713 - ET MALWARE TA444 Related Domain in DNS Lookup (starbucls .xyz) (malware.rules)
  • 2046714 - ET MALWARE Win32/Sinresby.B Checkin (malware.rules)
  • 2046715 - ET PHISHING Successful Yahoo Credential Phish 2023-06-30 (phishing.rules)

Pro:

  • 2844924 - ETPRO COINMINER Observed Litecoin Activity (coinminer.rules)

Disabled and modified rules:

  • 2850924 - ETPRO PHISHING Successful Generic Phish 2022-01-25 (phishing.rules)

Removed rules:

  • 2844924 - ETPRO POLICY Observed Litecoin Activity (policy.rules)