Summary:
4 new OPEN, 10 new PRO (4 + 6)
Added rules:
Open:
- 2053745 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (rvandccc .com) (exploit_kit.rules)
- 2053746 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (pelicanbcnsolutions .com) (exploit_kit.rules)
- 2053747 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (rvandccc .com) (exploit_kit.rules)
- 2053748 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (pelicanbcnsolutions .com) (exploit_kit.rules)
Pro:
- 2857286 - ETPRO MALWARE Python Cstealer/SatanStealer Exfiltrating to Discord CnC (malware.rules)
- 2857287 - ETPRO MALWARE Python Cstealer/SatanStealer Discord JS Inject Inbound (malware.rules)
- 2857288 - ETPRO MOBILE_MALWARE Android/Spy.Agent.DGI CnC Domain in DNS Lookup (mobile_malware.rules)
- 2857289 - ETPRO MOBILE_MALWARE Android/Spy.Agent.BRN CnC Domain in DNS Lookup (mobile_malware.rules)
- 2857290 - ETPRO MOBILE_MALWARE Android/Spy.Agent.DCP CnC Domain in DNS Lookup (mobile_malware.rules)
- 2857291 - ETPRO MOBILE_MALWARE Android/Spy.Banker.BZD CnC Domain in DNS Lookup (mobile_malware.rules)
Disabled and modified rules:
- 2049412 - ET MALWARE SocGholish Domain in DNS Lookup (dashboard .renovationsruth .com) (malware.rules)
- 2049413 - ET MALWARE SocGholish Domain in TLS SNI (dashboard .renovationsruth .com) (malware.rules)