Ruleset Update Summary - 2023/07/27 - v10381

Ruleset Updates
1

Summary:

3 new OPEN, 4 new PRO (3 + 1)

Thanks Kevin Ross and @Jane_0sint

Added rules:

Open:

  • 2046948 - ET MALWARE Pupy RAT Default TLS Proxy Certificate (malware.rules)
  • 2046949 - ET MALWARE MalDoc/Gamaredon CnC Activity M4 (malware.rules)
  • 2046950 - ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M3 (malware.rules)

Pro:

  • 2854942 - ETPRO MALWARE Win32/Raspberry Robin CnC Activity (GET) (malware.rules)

Modified inactive rules:

  • 2025019 - ET MALWARE Possible NanoCore C2 60B (malware.rules)
  • 2035211 - ET MALWARE Win32/QuasarRAT CnC Traffic (malware.rules)
  • 2046726 - ET MALWARE [ANY.RUN] Hydrochasma Fast Reverse Proxy M1 (malware.rules)

Disabled and modified rules:

  • 2031252 - ET MALWARE Turla/Crutch CnC Domain in DNS Lookup (hotspot .accesscam .org) (malware.rules)
  • 2031253 - ET MALWARE Turla/Crutch CnC Domain in DNS Lookup (highcolumn .webredirect .org) (malware.rules)
  • 2031254 - ET MALWARE Turla/Crutch CnC Domain in DNS Lookup (ethdns .mywire .org) (malware.rules)
  • 2031255 - ET MALWARE Turla/Crutch CnC Domain in DNS Lookup (theguardian .webredirect .org) (malware.rules)
  • 2046761 - ET MALWARE Observed Turla/Crutch Domain (hotspot .accesscam .org in TLS SNI) (malware.rules)