Ruleset Update Summary - 2023/10/17 - v10443

Ruleset Updates
1

Summary:

4 new OPEN, 6 new PRO (4 + 2)

Thanks @TalosSecurity

Added rules:

Open:

  • 2048581 - ET CURRENT_EVENTS Possible Atlassian Confluence CVE-2023-22515 Scan Activity - Clone (current_events.rules)
  • 2048582 - ET INFO Commonly Abused Domain in DNS Lookup (rf .gd) (info.rules)
  • 2048583 - ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Outbound) (exploit.rules)
  • 2048584 - ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Inbound) (exploit.rules)

Pro:

  • 2855365 - ETPRO MALWARE TA453 Related Domain in DNS Lookup (malware.rules)
  • 2855366 - ETPRO MALWARE Observed TA453 Related Domain in TLS SNI (malware.rules)
1 Like