Ruleset Update Summary - 2023/09/21 - v10422

Ruleset Updates
1

Summary:

6 new OPEN, 7 new PRO (6 + 1)

Thanks @Vectra_AI

Added rules:

Open:

  • 2036627 - ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M1 (info.rules)
  • 2048051 - ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M2 (info.rules)
  • 2048143 - ET INFO ScreenConnect/ConnectWise Initial Checkin Packet M3 (info.rules)
  • 2048144 - ET PHISHING TOAD CnC Domain in DNS Lookup (eshopper .top) (phishing.rules)
  • 2048145 - ET PHISHING Observed TOAD Domain (eshopper .top in TLS SNI) (phishing.rules)
  • 2048146 - ET EXPLOIT Possible Barracuda Email Security Gateway Remote Code Execution Attempt (CVE-2023-2868) M2 (exploit.rules)

Pro:

  • 2839081 - ETPRO INFO External IP Lookup - myip ipip .net (info.rules)

Removed rules:

  • 2036627 - ET POLICY ScreenConnect-ConnectWise Initial Checkin Packet M1 (policy.rules)
  • 2048051 - ET POLICY ScreenConnect-ConnectWise Initial Checkin Packet M2 (policy.rules)
  • 2839081 - ETPRO POLICY External IP Lookup - myip ipip .net (policy.rules)