Ruleset Update Summary - 2024/10/30 - v10731

Ruleset Updates
1

Summary:

12 new OPEN, 12 new PRO (12 + 0)

Added rules:

Open:

  • 2057150 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (relaxatiyon .cyou) (malware.rules)
  • 2057151 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (relaxatiyon .cyou in TLS SNI) (malware.rules)
  • 2057152 - ET EXPLOIT_KIT TA569 Middleware Domain in DNS Lookup (loopconstruct .com) (exploit_kit.rules)
  • 2057153 - ET EXPLOIT_KIT TA569 Middleware Domain in TLS SNI (loopconstruct .com) (exploit_kit.rules)
  • 2057154 - ET WEB_SPECIFIC_APPS Cyberpanel upgrademysqlstatus Command Injection Attempt (CVE-2024-51567) (web_specific_apps.rules)
  • 2057155 - ET EXPLOIT_KIT Balada Domain in DNS Lookup (startservicefounds .com) (exploit_kit.rules)
  • 2057156 - ET EXPLOIT_KIT Balada Domain in TLS SNI (startservicefounds .com) (exploit_kit.rules)
  • 2057157 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (omegaarea .site) (exploit_kit.rules)
  • 2057158 - ET WEB_SPECIFIC_APPS Cyberpanel filemanager Command Injection Attempt (CVE-2024-51568) (web_specific_apps.rules)
  • 2057159 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (omegaarea .site) (exploit_kit.rules)
  • 2057160 - ET MALWARE Win32/BugSleep CnC Checkin (malware.rules)
  • 2057161 - ET MALWARE Win32/BugSleep Command Response From C2 (malware.rules)

Disabled and modified rules:

  • 2858834 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)