[***] Summary: [***]
10 new Open, 36 new Pro (10 + 26). AntSword, BAZAR, Win32/Mr.Robot Ransomware, Win32/Remcos, Griffon, Various SSL, VARIOUS Phishing.
Please be aware that after the deprecation of our Suricata 2/3 support (April 15th 2020), the path for downloading the last pushed production Suricata 2/3 rulesets have changed. Deprecated rulesets are available at https://rules.emergingthreatspro.com/OINK/old for ETPro and https://rules.emergingthreatspro.com/open/old/ for ETOpen. All requests for the Suricata 2/3 at their previous locations will now lead to the Suricata 4.0 production rules for ETPro and the rule download instructions for ETOpen.
Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback
[+++] Added rules: [+++]
Open:
2030035 - ET TROJAN AntSword Webshell User-Agent Observed (trojan.rules)
2030036 - ET WEB_SERVER AntSword Webshell Commands Inbound
(web_server.rules)
2030037 - ET WEB_SERVER Possible AntSword Webshell Commands Inbound
(web_server.rules)
2030038 - ET TROJAN DonotGroup CnC Domain in DNS Query (trojan.rules)
2030039 - ET TROJAN Parallax CnC Response Activity M9 (trojan.rules)
2030041 - ET TROJAN BAZAR CnC Domain in DNS Lookup (trojan.rules)
2030042 - ET TROJAN BAZAR CnC Domain in DNS Lookup (trojan.rules)
2030043 - ET TROJAN BAZAR CnC Domain in DNS Lookup (trojan.rules)
2030044 - ET TROJAN BAZAR CnC Domain in DNS Lookup (trojan.rules)
2030045 - ET TROJAN BAZAR CnC Domain in DNS Lookup (trojan.rules)
Pro:
2842230 - ETPRO POLICY External IP Lookup via plain-text-ip .com
(policy.rules)
2842231 - ETPRO TROJAN Win32/njRAT Variant CnC Checkin (info)
(trojan.rules)
2842232 - ETPRO TROJAN Win32/njRAT Variant CnC Keep-Alive (Outbound)
(trojan.rules)
2842233 - ETPRO TROJAN Win32/Unk.Stealer Exfil via HTTP POST M2
(trojan.rules)
2842234 - ETPRO TROJAN Win32/Mr.Robot Ransomware CnC Checkin
(trojan.rules)
2842235 - ETPRO TROJAN Win32/Mr.Robot Ransomware CnC Keep-Alive
(Outbound) (trojan.rules)
2842236 - ETPRO TROJAN Win32/Mr.Robot Ransomware Requesting Payment
Amount (trojan.rules)
2842237 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 1) (trojan.rules)
2842238 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 2) (trojan.rules)
2842239 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 3) (trojan.rules)
2842240 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 4) (trojan.rules)
2842241 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 5) (trojan.rules)
2842242 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-28 6) (trojan.rules)
2842243 - ETPRO CURRENT_EVENTS Successful Microsoft Account Phish
2020-04-28 (current_events.rules)
2842244 - ETPRO CURRENT_EVENTS Successful Verizon Phish 2020-04-28
(current_events.rules)
2842245 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-04-28
(current_events.rules)
2842246 - ETPRO CURRENT_EVENTS Successful MWeb Phish 2020-04-28
(current_events.rules)
2842247 - ETPRO TROJAN MSIL/Spy.Agent.QN Variant CnC Account Exfil
(trojan.rules)
2842248 - ETPRO TROJAN Griffon CnC Activity (trojan.rules)
2842249 - ETPRO TROJAN SSL/TLS Certificate Observed (Griffon)
(trojan.rules)
2842250 - ETPRO TROJAN Unk.VBS Loader CnC Host Checkin (trojan.rules)
2842251 - ETPRO TROJAN SSL/TLS Certificate Observed (More_eggs)
(trojan.rules)
2842252 - ETPRO TROJAN SSL/TLS Certificate Observed (Unk.VBS)
(trojan.rules)
2842253 - ETPRO TROJAN MSIL/Disfa Encrypted CnC Response 1 (trojan.rules)
2842254 - ETPRO TROJAN MSIL/Disfa Encrypted CnC Response 2 (trojan.rules)
2842255 - ETPRO MALWARE Win32/SysTweak Checkin (malware.rules)
[///] Modified active rules: [///]
2018156 - ET EXPLOIT Linksys Auth Bypass fw_sys_up.cgi (exploit.rules)
2018157 - ET EXPLOIT Linksys Auth Bypass override.cgi (exploit.rules)
2018158 - ET EXPLOIT Linksys Auth Bypass share_editor.cgi (exploit.rules)
2018159 - ET EXPLOIT Linksys Auth Bypass switch_boot.cgi (exploit.rules)
2018168 - ET WEB_SPECIFIC_APPS MediaWiki thumb.php RCE
(web_specific_apps.rules)
2026946 - ET TROJAN GanDownloader CnC Checkin (trojan.rules)
2029606 - ET TROJAN MSIL/Firebird RAT CnC Checkin (trojan.rules)
2029996 - ET TROJAN NanoCore RAT CnC 27 (trojan.rules)
2030006 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
2805748 - ETPRO TROJAN TROJ_GEN.F47V1018 Checkin (trojan.rules)
2807472 - ETPRO TROJAN Win32/Bervod.A (trojan.rules)
2807704 - ETPRO TROJAN Fake installshie1d 1 (trojan.rules)
2807705 - ETPRO TROJAN Fake installshie1d 2 (trojan.rules)
2807712 - ETPRO TROJAN Win32/Rovnix.J Checkin (trojan.rules)
2840310 - ETPRO TROJAN Win32/Valak Generic CnC Activity (trojan.rules)
2842178 - ETPRO TROJAN ELF/Gafygt Variant Malicious Bash Script Inbound
(trojan.rules)
[---] Removed rules: [---]
2842221 - ETPRO TROJAN Parallax CnC Response Activity M9 (trojan.rules)