Ruleset Update Summary - 2024/06/19 - v10621

Ruleset Updates
1

Summary:

4 new OPEN, 10 new PRO (4 + 6)

Added rules:

Open:

  • 2053745 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (rvandccc .com) (exploit_kit.rules)
  • 2053746 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (pelicanbcnsolutions .com) (exploit_kit.rules)
  • 2053747 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (rvandccc .com) (exploit_kit.rules)
  • 2053748 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (pelicanbcnsolutions .com) (exploit_kit.rules)

Pro:

  • 2857286 - ETPRO MALWARE Python Cstealer/SatanStealer Exfiltrating to Discord CnC (malware.rules)
  • 2857287 - ETPRO MALWARE Python Cstealer/SatanStealer Discord JS Inject Inbound (malware.rules)
  • 2857288 - ETPRO MOBILE_MALWARE Android/Spy.Agent.DGI CnC Domain in DNS Lookup (mobile_malware.rules)
  • 2857289 - ETPRO MOBILE_MALWARE Android/Spy.Agent.BRN CnC Domain in DNS Lookup (mobile_malware.rules)
  • 2857290 - ETPRO MOBILE_MALWARE Android/Spy.Agent.DCP CnC Domain in DNS Lookup (mobile_malware.rules)
  • 2857291 - ETPRO MOBILE_MALWARE Android/Spy.Banker.BZD CnC Domain in DNS Lookup (mobile_malware.rules)

Disabled and modified rules:

  • 2049412 - ET MALWARE SocGholish Domain in DNS Lookup (dashboard .renovationsruth .com) (malware.rules)
  • 2049413 - ET MALWARE SocGholish Domain in TLS SNI (dashboard .renovationsruth .com) (malware.rules)