Summary:
18 new OPEN, 37 new PRO (18 + 19)
Thanks @Huntio
Added rules:
Open:
- 2055246 - ET PHISHING TA453 Domain in DNS Lookup (d75 .site) (phishing.rules)
- 2055247 - ET PHISHING TA453 Domain in TLS SNI (d75 .site) (phishing.rules)
- 2055248 - ET EXPLOIT_KIT ClearFake Domain in DNS Lookup (bigdownload .xyz) (exploit_kit.rules)
- 2055249 - ET EXPLOIT_KIT ClearFake Domain in TLS SNI (bigdownload .xyz) (exploit_kit.rules)
- 2055250 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (supfoundrysettlers .us) (malware.rules)
- 2055251 - ET MALWARE Oyster Backdoor Domain in TLS SNI (supfoundrysettlers .us) (malware.rules)
- 2055252 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (wherehomebe .com) (malware.rules)
- 2055253 - ET MALWARE Oyster Backdoor Domain in TLS SNI (wherehomebe .com) (malware.rules)
- 2055254 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (retdirectyourman .eu) (malware.rules)
- 2055255 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (codeforprofessionalusers .com) (malware.rules)
- 2055256 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (postmastersoriginals .com) (malware.rules)
- 2055257 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (firstcountryours .eu) (malware.rules)
- 2055258 - ET MALWARE Oyster Backdoor Domain in DNS Lookup (dotnetisforchildren .com) (malware.rules)
- 2055259 - ET MALWARE Oyster Backdoor Domain in TLS SNI (retdirectyourman .eu) (malware.rules)
- 2055260 - ET MALWARE Oyster Backdoor Domain in TLS SNI (codeforprofessionalusers .com) (malware.rules)
- 2055261 - ET MALWARE Oyster Backdoor Domain in TLS SNI (postmastersoriginals .com) (malware.rules)
- 2055262 - ET MALWARE Oyster Backdoor Domain in TLS SNI (firstcountryours .eu) (malware.rules)
- 2055263 - ET MALWARE Oyster Backdoor Domain in TLS SNI (dotnetisforchildren .com) (malware.rules)
Pro:
- 2857901 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2857902 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2857903 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2857904 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2857905 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2857906 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2857907 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2857908 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2857909 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
- 2857910 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
- 2857911 - ETPRO PHISHING TA425 Domain in DNS Lookup (phishing.rules)
- 2857912 - ETPRO PHISHING TA425 Domain in DNS Lookup (phishing.rules)
- 2857913 - ETPRO PHISHING TA425 Domain in DNS Lookup (phishing.rules)
- 2857914 - ETPRO PHISHING TA425 Domain in DNS Lookup (phishing.rules)
- 2857915 - ETPRO PHISHING TA425 Domain in TLS SNI (phishing.rules)
- 2857916 - ETPRO PHISHING TA425 Domain in TLS SNI (phishing.rules)
- 2857917 - ETPRO PHISHING TA425 Domain in TLS SNI (phishing.rules)
- 2857918 - ETPRO PHISHING TA425 Domain in TLS SNI (phishing.rules)
- 2857919 - ETPRO MALWARE Oyster Backdoor CnC Checkin (malware.rules)
Removed rules:
- 2052445 - ET PHISHING TA453 Domain in DNS Lookup (phishing.rules)
- 2052446 - ET PHISHING TA453 Domain in TLS SNI (phishing.rules)