Ruleset Update Summary - 2025/01/10 - v10835

Ruleset Updates
1

Summary:

10 new OPEN, 15 new PRO (10 + 5)

Added rules:

Open:

  • 2059117 - ET WEB_SPECIFIC_APPS Roundcube rcube_washtml.php SVG Cross-Site Scripting (CVE-2023-5631) (web_specific_apps.rules)
  • 2059118 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (jumplilltk .cfd) (malware.rules)
  • 2059119 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (jumplilltk .cfd in TLS SNI) (malware.rules)
  • 2059120 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (letterdrive .shop) (malware.rules)
  • 2059121 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (letterdrive .shop in TLS SNI) (malware.rules)
  • 2059122 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (glccf .com) (exploit_kit.rules)
  • 2059123 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (glccf .com) (exploit_kit.rules)
  • 2059124 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (apex-shop .online) (exploit_kit.rules)
  • 2059125 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (apex-shop .online) (exploit_kit.rules)
  • 2059126 - ET INFO Outbound SMB2 NTLM Auth Attempt to Internal Address (info.rules)

Pro:

  • 2859560 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) (malware.rules)
  • 2859561 - ETPRO MALWARE StrelaStealer CnC Exfil (POST) (malware.rules)
  • 2859562 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
  • 2859563 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
  • 2859564 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)

Disabled and modified rules:

  • 2056489 - ET EXPLOIT_KIT CC Skimmer Domain in DNS Lookup (chartzend .com) (exploit_kit.rules)
  • 2057331 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (junocis .com) (exploit_kit.rules)
  • 2057332 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (junocis .com) (exploit_kit.rules)
  • 2057380 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (culinarycanvasgrilling .com) (exploit_kit.rules)
  • 2057381 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (culinarycanvasgrilling .com) (exploit_kit.rules)
  • 2059092 - ET EXPLOIT_KIT CC Skimmer Domain in DNS Lookup (chartzend .com) (exploit_kit.rules)
  • 2859428 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
  • 2859438 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
  • 2859439 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
  • 2859454 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
  • 2859455 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)
  • 2859456 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)