Ruleset Update Summary - 2026/07/02 - v11226

Ruleset Updates
1

Summary:

215 new OPEN, 219 new PRO (215 + 4)

There will be no release tomorrow, Friday July 3rd.

Added rules:

Open:

  • 2070145 - ET MALWARE MarkiRAT Domain in DNS Lookup (come-site .website) (malware.rules)
  • 2070146 - ET MALWARE MarkiRAT Domain in DNS Lookup (comisignin .online) (malware.rules)
  • 2070147 - ET MALWARE MarkiRAT Domain in DNS Lookup (comview .website) (malware.rules)
  • 2070148 - ET MALWARE MarkiRAT Domain in DNS Lookup (com-accounts .website) (malware.rules)
  • 2070149 - ET MALWARE MarkiRAT Domain in DNS Lookup (comesite .website) (malware.rules)
  • 2070150 - ET MALWARE MarkiRAT Domain in DNS Lookup (yemplayer .site) (malware.rules)
  • 2070151 - ET MALWARE MarkiRAT Domain in DNS Lookup (comi-site .website) (malware.rules)
  • 2070152 - ET MALWARE MarkiRAT Domain in DNS Lookup (migavpn .store) (malware.rules)
  • 2070153 - ET MALWARE MarkiRAT Domain in DNS Lookup (yeplayer .store) (malware.rules)
  • 2070154 - ET MALWARE MarkiRAT Domain in DNS Lookup (comesignt .website) (malware.rules)
  • 2070155 - ET MALWARE MarkiRAT Domain in DNS Lookup (com-signin .site) (malware.rules)
  • 2070156 - ET MALWARE MarkiRAT Domain in DNS Lookup (pis2ray .online) (malware.rules)
  • 2070157 - ET MALWARE MarkiRAT Domain in DNS Lookup (sahar2ray .online) (malware.rules)
  • 2070158 - ET MALWARE MarkiRAT Domain in DNS Lookup (comestore .site) (malware.rules)
  • 2070159 - ET MALWARE MarkiRAT Domain in DNS Lookup (come-signin .quest) (malware.rules)
  • 2070160 - ET MALWARE MarkiRAT Domain in DNS Lookup (comx-view .store) (malware.rules)
  • 2070161 - ET MALWARE MarkiRAT Domain in DNS Lookup (orbitx .site) (malware.rules)
  • 2070162 - ET MALWARE Observed MarkiRAT Domain (come-site .website in TLS SNI) (malware.rules)
  • 2070163 - ET MALWARE Observed MarkiRAT Domain (comisignin .online in TLS SNI) (malware.rules)
  • 2070164 - ET MALWARE Observed MarkiRAT Domain (comview .website in TLS SNI) (malware.rules)
  • 2070165 - ET MALWARE Observed MarkiRAT Domain (com-accounts .website in TLS SNI) (malware.rules)
  • 2070166 - ET MALWARE Observed MarkiRAT Domain (comesite .website in TLS SNI) (malware.rules)
  • 2070167 - ET MALWARE Observed MarkiRAT Domain (yemplayer .site in TLS SNI) (malware.rules)
  • 2070168 - ET MALWARE Observed MarkiRAT Domain (comi-site .website in TLS SNI) (malware.rules)
  • 2070169 - ET MALWARE Observed MarkiRAT Domain (migavpn .store in TLS SNI) (malware.rules)
  • 2070170 - ET MALWARE Observed MarkiRAT Domain (yeplayer .store in TLS SNI) (malware.rules)
  • 2070171 - ET MALWARE Observed MarkiRAT Domain (comesignt .website in TLS SNI) (malware.rules)
  • 2070172 - ET MALWARE Observed MarkiRAT Domain (com-signin .site in TLS SNI) (malware.rules)
  • 2070173 - ET MALWARE Observed MarkiRAT Domain (pis2ray .online in TLS SNI) (malware.rules)
  • 2070174 - ET MALWARE Observed MarkiRAT Domain (sahar2ray .online in TLS SNI) (malware.rules)
  • 2070175 - ET MALWARE Observed MarkiRAT Domain (comestore .site in TLS SNI) (malware.rules)
  • 2070176 - ET MALWARE Observed MarkiRAT Domain (come-signin .quest in TLS SNI) (malware.rules)
  • 2070177 - ET MALWARE Observed MarkiRAT Domain (comx-view .store in TLS SNI) (malware.rules)
  • 2070178 - ET MALWARE Observed MarkiRAT Domain (orbitx .site in TLS SNI) (malware.rules)
  • 2070179 - ET MALWARE MarkiRAT CnC Checkin Attempt (malware.rules)
  • 2070180 - ET MALWARE MarkiRAT Data Exfiltration Attempt (malware.rules)
  • 2070181 - ET MALWARE PureRAT TLS Certificate Observed (PureRAT Agent) (malware.rules)
  • 2070182 - ET INFO DYNAMIC_DNS Query to a *.tar .nz domain (info.rules)
  • 2070183 - ET INFO DYNAMIC_DNS HTTP Request to a *.tar .nz domain (info.rules)
  • 2070184 - ET INFO DYNAMIC_DNS Query to a *.savwhatsup .org domain (info.rules)
  • 2070185 - ET INFO DYNAMIC_DNS HTTP Request to a *.savwhatsup .org domain (info.rules)
  • 2070186 - ET INFO DYNAMIC_DNS Query to a *.findelschnecke .com domain (info.rules)
  • 2070187 - ET INFO DYNAMIC_DNS HTTP Request to a *.findelschnecke .com domain (info.rules)
  • 2070188 - ET INFO DYNAMIC_DNS Query to a *.e-alon .com domain (info.rules)
  • 2070189 - ET INFO DYNAMIC_DNS HTTP Request to a *.e-alon .com domain (info.rules)
  • 2070190 - ET INFO DYNAMIC_DNS Query to a *.manasrajaram .com domain (info.rules)
  • 2070191 - ET INFO DYNAMIC_DNS HTTP Request to a *.manasrajaram .com domain (info.rules)
  • 2070192 - ET INFO DYNAMIC_DNS Query to a *.bfbsystems .net domain (info.rules)
  • 2070193 - ET INFO DYNAMIC_DNS HTTP Request to a *.bfbsystems .net domain (info.rules)
  • 2070194 - ET INFO DYNAMIC_DNS Query to a *.mymywant .com domain (info.rules)
  • 2070195 - ET INFO DYNAMIC_DNS HTTP Request to a *.mymywant .com domain (info.rules)
  • 2070196 - ET INFO DYNAMIC_DNS Query to a *.mitcpw .org domain (info.rules)
  • 2070197 - ET INFO DYNAMIC_DNS HTTP Request to a *.mitcpw .org domain (info.rules)
  • 2070198 - ET INFO DYNAMIC_DNS Query to a *.tulanerw .org domain (info.rules)
  • 2070199 - ET INFO DYNAMIC_DNS HTTP Request to a *.tulanerw .org domain (info.rules)
  • 2070200 - ET INFO DYNAMIC_DNS Query to a *.ruimiranda .com domain (info.rules)
  • 2070201 - ET INFO DYNAMIC_DNS HTTP Request to a *.ruimiranda .com domain (info.rules)
  • 2070202 - ET INFO DYNAMIC_DNS Query to a *.highdesertcoders .com domain (info.rules)
  • 2070203 - ET INFO DYNAMIC_DNS HTTP Request to a *.highdesertcoders .com domain (info.rules)
  • 2070204 - ET INFO DYNAMIC_DNS Query to a *.nursph .org domain (info.rules)
  • 2070205 - ET INFO DYNAMIC_DNS HTTP Request to a *.nursph .org domain (info.rules)
  • 2070206 - ET INFO DYNAMIC_DNS Query to a *.garnier-audebourg .org domain (info.rules)
  • 2070207 - ET INFO DYNAMIC_DNS HTTP Request to a *.garnier-audebourg .org domain (info.rules)
  • 2070208 - ET INFO DYNAMIC_DNS Query to a *.jonmills .org domain (info.rules)
  • 2070209 - ET INFO DYNAMIC_DNS HTTP Request to a *.jonmills .org domain (info.rules)
  • 2070210 - ET INFO DYNAMIC_DNS Query to a *.hkmtta .com domain (info.rules)
  • 2070211 - ET INFO DYNAMIC_DNS HTTP Request to a *.hkmtta .com domain (info.rules)
  • 2070212 - ET INFO DYNAMIC_DNS Query to a *.horizonpublishingllc .com domain (info.rules)
  • 2070213 - ET INFO DYNAMIC_DNS HTTP Request to a *.horizonpublishingllc .com domain (info.rules)
  • 2070214 - ET INFO DYNAMIC_DNS Query to a *.seclogistic .com domain (info.rules)
  • 2070215 - ET INFO DYNAMIC_DNS HTTP Request to a *.seclogistic .com domain (info.rules)
  • 2070216 - ET INFO DYNAMIC_DNS Query to a *.mypjnr .org domain (info.rules)
  • 2070217 - ET INFO DYNAMIC_DNS HTTP Request to a *.mypjnr .org domain (info.rules)
  • 2070218 - ET INFO DYNAMIC_DNS Query to a *.autoescuelaelsoto .com domain (info.rules)
  • 2070219 - ET INFO DYNAMIC_DNS HTTP Request to a *.autoescuelaelsoto .com domain (info.rules)
  • 2070220 - ET INFO DYNAMIC_DNS Query to a *.e1racecar .com domain (info.rules)
  • 2070221 - ET INFO DYNAMIC_DNS HTTP Request to a *.e1racecar .com domain (info.rules)
  • 2070222 - ET INFO DYNAMIC_DNS Query to a *.e1-racecar .com domain (info.rules)
  • 2070223 - ET INFO DYNAMIC_DNS HTTP Request to a *.e1-racecar .com domain (info.rules)
  • 2070224 - ET INFO DYNAMIC_DNS Query to a *.gipsitv .org domain (info.rules)
  • 2070225 - ET INFO DYNAMIC_DNS HTTP Request to a *.gipsitv .org domain (info.rules)
  • 2070226 - ET INFO DYNAMIC_DNS Query to a *.inthepress .org domain (info.rules)
  • 2070227 - ET INFO DYNAMIC_DNS HTTP Request to a *.inthepress .org domain (info.rules)
  • 2070228 - ET INFO DYNAMIC_DNS Query to a *.uwgraduation .org domain (info.rules)
  • 2070229 - ET INFO DYNAMIC_DNS HTTP Request to a *.uwgraduation .org domain (info.rules)
  • 2070230 - ET INFO DYNAMIC_DNS Query to a *.numotive .com domain (info.rules)
  • 2070231 - ET INFO DYNAMIC_DNS HTTP Request to a *.numotive .com domain (info.rules)
  • 2070232 - ET INFO DYNAMIC_DNS Query to a *.johncroth .com domain (info.rules)
  • 2070233 - ET INFO DYNAMIC_DNS HTTP Request to a *.johncroth .com domain (info.rules)
  • 2070234 - ET INFO DYNAMIC_DNS Query to a *.taoism-dingshun .org domain (info.rules)
  • 2070235 - ET INFO DYNAMIC_DNS HTTP Request to a *.taoism-dingshun .org domain (info.rules)
  • 2070236 - ET INFO DYNAMIC_DNS Query to a *.sostech .net .au domain (info.rules)
  • 2070237 - ET INFO DYNAMIC_DNS HTTP Request to a *.sostech .net .au domain (info.rules)
  • 2070238 - ET INFO DYNAMIC_DNS Query to a *.snapsaway .com domain (info.rules)
  • 2070239 - ET INFO DYNAMIC_DNS HTTP Request to a *.snapsaway .com domain (info.rules)
  • 2070240 - ET INFO DYNAMIC_DNS Query to a *.hasley .org domain (info.rules)
  • 2070241 - ET INFO DYNAMIC_DNS HTTP Request to a *.hasley .org domain (info.rules)
  • 2070242 - ET INFO DYNAMIC_DNS Query to a *.eaa608 .org domain (info.rules)
  • 2070243 - ET INFO DYNAMIC_DNS HTTP Request to a *.eaa608 .org domain (info.rules)
  • 2070244 - ET INFO DYNAMIC_DNS Query to a *.infomasc .com .ar domain (info.rules)
  • 2070245 - ET INFO DYNAMIC_DNS HTTP Request to a *.infomasc .com .ar domain (info.rules)
  • 2070246 - ET INFO DYNAMIC_DNS Query to a *.jacqandwillwentupthehill .com domain (info.rules)
  • 2070247 - ET INFO DYNAMIC_DNS HTTP Request to a *.jacqandwillwentupthehill .com domain (info.rules)
  • 2070248 - ET INFO DYNAMIC_DNS Query to a *.zombiehitmen .com domain (info.rules)
  • 2070249 - ET INFO DYNAMIC_DNS HTTP Request to a *.zombiehitmen .com domain (info.rules)
  • 2070250 - ET INFO DYNAMIC_DNS Query to a *.theinoob .com domain (info.rules)
  • 2070251 - ET INFO DYNAMIC_DNS HTTP Request to a *.theinoob .com domain (info.rules)
  • 2070252 - ET INFO DYNAMIC_DNS Query to a *.ekhatri .net domain (info.rules)
  • 2070253 - ET INFO DYNAMIC_DNS HTTP Request to a *.ekhatri .net domain (info.rules)
  • 2070254 - ET INFO DYNAMIC_DNS Query to a *.dagmaar .com domain (info.rules)
  • 2070255 - ET INFO DYNAMIC_DNS HTTP Request to a *.dagmaar .com domain (info.rules)
  • 2070256 - ET INFO DYNAMIC_DNS Query to a *.7btech .com domain (info.rules)
  • 2070257 - ET INFO DYNAMIC_DNS HTTP Request to a *.7btech .com domain (info.rules)
  • 2070258 - ET INFO DYNAMIC_DNS Query to a *.rotorootie .net domain (info.rules)
  • 2070259 - ET INFO DYNAMIC_DNS HTTP Request to a *.rotorootie .net domain (info.rules)
  • 2070260 - ET INFO DYNAMIC_DNS Query to a *.adaward .com domain (info.rules)
  • 2070261 - ET INFO DYNAMIC_DNS HTTP Request to a *.adaward .com domain (info.rules)
  • 2070262 - ET INFO DYNAMIC_DNS Query to a *.badrag .net domain (info.rules)
  • 2070263 - ET INFO DYNAMIC_DNS HTTP Request to a *.badrag .net domain (info.rules)
  • 2070264 - ET INFO DYNAMIC_DNS Query to a *.hiswordbroadcasting .net domain (info.rules)
  • 2070265 - ET INFO DYNAMIC_DNS HTTP Request to a *.hiswordbroadcasting .net domain (info.rules)
  • 2070266 - ET INFO DYNAMIC_DNS Query to a *.riaueventorganizer .com domain (info.rules)
  • 2070267 - ET INFO DYNAMIC_DNS HTTP Request to a *.riaueventorganizer .com domain (info.rules)
  • 2070268 - ET INFO DYNAMIC_DNS Query to a *.northamericanlockandsafe .com domain (info.rules)
  • 2070269 - ET INFO DYNAMIC_DNS HTTP Request to a *.northamericanlockandsafe .com domain (info.rules)
  • 2070270 - ET INFO DYNAMIC_DNS Query to a *.luccamonti .com domain (info.rules)
  • 2070271 - ET INFO DYNAMIC_DNS HTTP Request to a *.luccamonti .com domain (info.rules)
  • 2070272 - ET INFO DYNAMIC_DNS Query to a *.fuckwikia .com domain (info.rules)
  • 2070273 - ET INFO DYNAMIC_DNS HTTP Request to a *.fuckwikia .com domain (info.rules)
  • 2070274 - ET INFO DYNAMIC_DNS Query to a *.ariefcyber .com domain (info.rules)
  • 2070275 - ET INFO DYNAMIC_DNS HTTP Request to a *.ariefcyber .com domain (info.rules)
  • 2070276 - ET INFO DYNAMIC_DNS Query to a *.benrowland .net domain (info.rules)
  • 2070277 - ET INFO DYNAMIC_DNS HTTP Request to a *.benrowland .net domain (info.rules)
  • 2070278 - ET INFO DYNAMIC_DNS Query to a *.fysiomotion .se domain (info.rules)
  • 2070279 - ET INFO DYNAMIC_DNS HTTP Request to a *.fysiomotion .se domain (info.rules)
  • 2070280 - ET INFO DYNAMIC_DNS Query to a *.ttyemupt .com domain (info.rules)
  • 2070281 - ET INFO DYNAMIC_DNS HTTP Request to a *.ttyemupt .com domain (info.rules)
  • 2070282 - ET INFO DYNAMIC_DNS Query to a *.le-baux .com domain (info.rules)
  • 2070283 - ET INFO DYNAMIC_DNS HTTP Request to a *.le-baux .com domain (info.rules)
  • 2070284 - ET INFO DYNAMIC_DNS Query to a *.k4dm .net domain (info.rules)
  • 2070285 - ET INFO DYNAMIC_DNS HTTP Request to a *.k4dm .net domain (info.rules)
  • 2070286 - ET INFO DYNAMIC_DNS Query to a *.alabamasalesrecruitment .com domain (info.rules)
  • 2070287 - ET INFO DYNAMIC_DNS HTTP Request to a *.alabamasalesrecruitment .com domain (info.rules)
  • 2070288 - ET INFO DYNAMIC_DNS Query to a *.steveward .org domain (info.rules)
  • 2070289 - ET INFO DYNAMIC_DNS HTTP Request to a *.steveward .org domain (info.rules)
  • 2070290 - ET INFO DYNAMIC_DNS Query to a *.wahasinarmas .com domain (info.rules)
  • 2070291 - ET INFO DYNAMIC_DNS HTTP Request to a *.wahasinarmas .com domain (info.rules)
  • 2070292 - ET INFO DYNAMIC_DNS Query to a *.chocopicacho .com domain (info.rules)
  • 2070293 - ET INFO DYNAMIC_DNS HTTP Request to a *.chocopicacho .com domain (info.rules)
  • 2070294 - ET INFO DYNAMIC_DNS Query to a *.donvogler .com domain (info.rules)
  • 2070295 - ET INFO DYNAMIC_DNS HTTP Request to a *.donvogler .com domain (info.rules)
  • 2070296 - ET INFO DYNAMIC_DNS Query to a *.hamrodolakha .com domain (info.rules)
  • 2070297 - ET INFO DYNAMIC_DNS HTTP Request to a *.hamrodolakha .com domain (info.rules)
  • 2070298 - ET INFO DYNAMIC_DNS Query to a *.sramage .net domain (info.rules)
  • 2070299 - ET INFO DYNAMIC_DNS HTTP Request to a *.sramage .net domain (info.rules)
  • 2070300 - ET INFO DYNAMIC_DNS Query to a *.molgas .org domain (info.rules)
  • 2070301 - ET INFO DYNAMIC_DNS HTTP Request to a *.molgas .org domain (info.rules)
  • 2070302 - ET INFO DYNAMIC_DNS Query to a *.sachikana .net domain (info.rules)
  • 2070303 - ET INFO DYNAMIC_DNS HTTP Request to a *.sachikana .net domain (info.rules)
  • 2070304 - ET INFO DYNAMIC_DNS Query to a *.pablogallego .com .ar domain (info.rules)
  • 2070305 - ET INFO DYNAMIC_DNS HTTP Request to a *.pablogallego .com .ar domain (info.rules)
  • 2070306 - ET INFO DYNAMIC_DNS Query to a *.sexualidadesrosario .com .ar domain (info.rules)
  • 2070307 - ET INFO DYNAMIC_DNS HTTP Request to a *.sexualidadesrosario .com .ar domain (info.rules)
  • 2070308 - ET INFO DYNAMIC_DNS Query to a *.ostrovska .sk domain (info.rules)
  • 2070309 - ET INFO DYNAMIC_DNS HTTP Request to a *.ostrovska .sk domain (info.rules)
  • 2070310 - ET INFO DYNAMIC_DNS Query to a *.226vitech .com domain (info.rules)
  • 2070311 - ET INFO DYNAMIC_DNS HTTP Request to a *.226vitech .com domain (info.rules)
  • 2070312 - ET INFO DYNAMIC_DNS Query to a *.quicquaro .com domain (info.rules)
  • 2070313 - ET INFO DYNAMIC_DNS HTTP Request to a *.quicquaro .com domain (info.rules)
  • 2070314 - ET INFO DYNAMIC_DNS Query to a *.edbask .net domain (info.rules)
  • 2070315 - ET INFO DYNAMIC_DNS HTTP Request to a *.edbask .net domain (info.rules)
  • 2070316 - ET INFO DYNAMIC_DNS Query to a *.giuras .org domain (info.rules)
  • 2070317 - ET INFO DYNAMIC_DNS HTTP Request to a *.giuras .org domain (info.rules)
  • 2070318 - ET INFO DYNAMIC_DNS Query to a *.ranftl .org domain (info.rules)
  • 2070319 - ET INFO DYNAMIC_DNS HTTP Request to a *.ranftl .org domain (info.rules)
  • 2070320 - ET INFO DYNAMIC_DNS Query to a *.jusiak .net domain (info.rules)
  • 2070321 - ET INFO DYNAMIC_DNS HTTP Request to a *.jusiak .net domain (info.rules)
  • 2070322 - ET INFO DYNAMIC_DNS Query to a *.insermase .net domain (info.rules)
  • 2070323 - ET INFO DYNAMIC_DNS HTTP Request to a *.insermase .net domain (info.rules)
  • 2070324 - ET INFO DYNAMIC_DNS Query to a *.sembiring .com domain (info.rules)
  • 2070325 - ET INFO DYNAMIC_DNS HTTP Request to a *.sembiring .com domain (info.rules)
  • 2070326 - ET INFO DYNAMIC_DNS Query to a *.c-abogados .com .ar domain (info.rules)
  • 2070327 - ET INFO DYNAMIC_DNS HTTP Request to a *.c-abogados .com .ar domain (info.rules)
  • 2070328 - ET INFO DYNAMIC_DNS Query to a *.laramonti .com domain (info.rules)
  • 2070329 - ET INFO DYNAMIC_DNS HTTP Request to a *.laramonti .com domain (info.rules)
  • 2070330 - ET INFO DYNAMIC_DNS Query to a *.ogecca .net domain (info.rules)
  • 2070331 - ET INFO DYNAMIC_DNS HTTP Request to a *.ogecca .net domain (info.rules)
  • 2070332 - ET INFO DYNAMIC_DNS Query to a *.ugnss .net domain (info.rules)
  • 2070333 - ET INFO DYNAMIC_DNS HTTP Request to a *.ugnss .net domain (info.rules)
  • 2070334 - ET INFO DYNAMIC_DNS Query to a *.hkmtta .org domain (info.rules)
  • 2070335 - ET INFO DYNAMIC_DNS HTTP Request to a *.hkmtta .org domain (info.rules)
  • 2070336 - ET INFO DYNAMIC_DNS Query to a *.rafflesiagroup .com .my domain (info.rules)
  • 2070337 - ET INFO DYNAMIC_DNS HTTP Request to a *.rafflesiagroup .com .my domain (info.rules)
  • 2070338 - ET INFO DYNAMIC_DNS Query to a *.kryksyh .org domain (info.rules)
  • 2070339 - ET INFO DYNAMIC_DNS HTTP Request to a *.kryksyh .org domain (info.rules)
  • 2070340 - ET INFO DYNAMIC_DNS Query to a *.about-anthony .com domain (info.rules)
  • 2070341 - ET INFO DYNAMIC_DNS HTTP Request to a *.about-anthony .com domain (info.rules)
  • 2070342 - ET INFO DYNAMIC_DNS Query to a *.technoreform .com domain (info.rules)
  • 2070343 - ET INFO DYNAMIC_DNS HTTP Request to a *.technoreform .com domain (info.rules)
  • 2070344 - ET INFO DYNAMIC_DNS Query to a *.gridtoroad .com domain (info.rules)
  • 2070345 - ET INFO DYNAMIC_DNS HTTP Request to a *.gridtoroad .com domain (info.rules)
  • 2070346 - ET INFO DYNAMIC_DNS Query to a *.golubovic .com .ar domain (info.rules)
  • 2070347 - ET INFO DYNAMIC_DNS HTTP Request to a *.golubovic .com .ar domain (info.rules)
  • 2070348 - ET INFO DYNAMIC_DNS Query to a *.carladutra .com .br domain (info.rules)
  • 2070349 - ET INFO DYNAMIC_DNS HTTP Request to a *.carladutra .com .br domain (info.rules)
  • 2070350 - ET INFO DYNAMIC_DNS Query to a *.homegecko .org domain (info.rules)
  • 2070351 - ET INFO DYNAMIC_DNS HTTP Request to a *.homegecko .org domain (info.rules)
  • 2070352 - ET INFO DYNAMIC_DNS Query to a *.bumon .ar domain (info.rules)
  • 2070353 - ET INFO DYNAMIC_DNS HTTP Request to a *.bumon .ar domain (info.rules)
  • 2070354 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fruityconsti .buzz) (malware.rules)
  • 2070355 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fruityconsti .buzz) in TLS SNI (malware.rules)
  • 2070356 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rushaxv .cyou) (malware.rules)
  • 2070357 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rushaxv .cyou) in TLS SNI (malware.rules)
  • 2070358 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shelfedpriveowp .shop) (malware.rules)
  • 2070359 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (shelfedpriveowp .shop) in TLS SNI (malware.rules)

Pro:

  • 2867878 - ETPRO PHISHING VENOM PhaaS Activity Gate Page Fingerprinting M1 (phishing.rules)
  • 2867879 - ETPRO PHISHING VENOM PhaaS Activity Gate Page Fingerprinting M2 (phishing.rules)
  • 2867880 - ETPRO PHISHING VENOM PhaaS Activity Gate Page Stage 2 URI (phishing.rules)
  • 2867881 - ETPRO MALWARE LOTUSLITE CnC Checkin (malware.rules)

Disabled and modified rules:

  • 2068767 - ET PHISHING Observed DNS Query to VENOM PhaaS Domain (gutmann .ae) (phishing.rules)
  • 2068775 - ET PHISHING Observed VENOM PhaaS Domain (gutmann .ae in TLS SNI) (phishing.rules)