Ruleset Update Summary - 2023/08/14 - v10393

Ruleset Updates
1

Summary:

15 new OPEN, 15 new PRO (15 + 0)

Thanks @EclecticIQ, @zscaler, @uptycs

Added rules:

Open:

  • 2047635 - ET INFO File Sharing Domain in DNS Lookup (drive .internxt .com) (info.rules)
  • 2047636 - ET INFO Observed File Sharing Domain (drive .internxt .com in TLS SNI) (info.rules)
  • 2047637 - ET MALWARE Suspected Bitter Elephant APT Related Activity (GET) (malware.rules)
  • 2047638 - ET MALWARE APT29 CnC Domain in DNS Lookup (sgrhf .org .pk) (malware.rules)
  • 2047639 - ET MALWARE APT29 CnC Domain in DNS Lookup (toyy .zulipchat .com) (malware.rules)
  • 2047640 - ET MALWARE APT29 CnC Domain in DNS Lookup (edenparkweddings .com) (malware.rules)
  • 2047641 - ET MALWARE Observed APT29 Domain (sgrhf .org .pk) in TLS SNI (malware.rules)
  • 2047642 - ET MALWARE Observed APT29 Domain (toyy .zulipchat .com) in TLS SNI (malware.rules)
  • 2047643 - ET MALWARE Observed APT29 Domain (edenparkweddings .com) in TLS SNI (malware.rules)
  • 2047644 - ET MALWARE APT29 Duke Variant Malware CnC Checkin Observed (malware.rules)
  • 2047645 - ET MALWARE APT29 HTA Dropper Checkin Observed (malware.rules)
  • 2047646 - ET MALWARE JanelaRAT CnC Checkin Observed (malware.rules)
  • 2047647 - ET MALWARE QwixxRAT - Telegram CnC Checkin (malware.rules)
  • 2047648 - ET EXPLOIT_KIT Fake Browser Update in DNS Lookup (exploit_kit.rules)
  • 2047649 - ET EXPLOIT_KIT Fake Browser Update in TLS SNI (exploit_kit.rules)