[***] Summary: [***]
3 Open, 26 Pro (3 + 23). Zerocrat, Babulya, USBFERRY, Various Phishing, Suri5 Updates.
Please be aware that after the deprecation of our Suricata 2/3 support (April 15th 2020), the path for downloading the last pushed production Suricata 2/3 rulesets have changed. Deprecated rulesets are available at https://rules.emergingthreatspro.com/OINK/old for ETPro and https://rules.emergingthreatspro.com/open/old/ for ETOpen. All requests for the Suricata 2/3 at their previous locations will now lead to the Suricata 4.0 production rules for ETPro and the rule download instructions for ETOpen.
Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback
[+++] Added rules: [+++]
Open:
2030168 - ET TROJAN GandCrab Style External IP Check (Spoofed Yahoo Host)
(trojan.rules)
2030169 - ET TROJAN Suspected USBFERRY CnC (trojan.rules)
2030170 - ET USER_AGENTS Suspicious User-Agent (MSIE) (user_agents.rules)
Pro:
2842587 - ETPRO TROJAN MalDoc Retrieving Payload 2020-05-14 (trojan.rules)
2842588 - ETPRO INFO Windows BITS UA Retrieving EXE M2 (info.rules)
2842589 - ETPRO TROJAN Observed Win32/Babulya User-Agent (trojan.rules)
2842590 - ETPRO INFO Request for Office Doc DL to DuckDNS DynDNS Domain
(info.rules)
2842591 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-15 1) (trojan.rules)
2842592 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-15 2) (trojan.rules)
2842593 - ETPRO TROJAN SSL/TLS Certificate Observed (Griffon)
(trojan.rules)
2842594 - ETPRO TROJAN SSL/TLS Certificate Observed (Unk/VBS Loader)
(trojan.rules)
2842595 - ETPRO CURRENT_EVENTS Successful Instagram Phish 2020-05-15
(current_events.rules)
2842596 - ETPRO CURRENT_EVENTS Successful Deutsche Bank Phish 2020-05-15
(current_events.rules)
2842597 - ETPRO CURRENT_EVENTS Successful UBI Banca Phish 2020-05-15
(current_events.rules)
2842598 - ETPRO CURRENT_EVENTS Successful Caixa Phish 2020-05-15
(current_events.rules)
2842599 - ETPRO CURRENT_EVENTS Successful Caixa Phish 2020-05-15
(current_events.rules)
2842600 - ETPRO CURRENT_EVENTS Successful Wells Fargo Phish 2020-05-15
(current_events.rules)
2842601 - ETPRO CURRENT_EVENTS Successful Wells Fargo Phish 2020-05-15
(current_events.rules)
2842602 - ETPRO CURRENT_EVENTS Successful Mimecast Phish 2020-05-15
(current_events.rules)
2842603 - ETPRO CURRENT_EVENTS Successful Banco de Chile Phish 2020-05-15
(current_events.rules)
2842604 - ETPRO CURRENT_EVENTS Successful Microsoft Account Phish
2020-05-15 (current_events.rules)
2842605 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-05-15
(current_events.rules)
2842606 - ETPRO CURRENT_EVENTS Successful OTP Group Bank Phish 2020-05-15
(current_events.rules)
2842607 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-05-15
(current_events.rules)
2842608 - ETPRO USER_AGENTS Suspicious User-Agent (OldAssBrowser)
(user_agents.rules)
2842609 - ETPRO TROJAN ZEROCRAT Client Info Post (trojan.rules)
[///] Modified active rules: [///]
2014997 - ET POLICY Pandora Usage (policy.rules)
2017633 - ET TROJAN Athena DDoS Bot Checkin (trojan.rules)
2019693 - ET TROJAN Emotet Checkin (trojan.rules)
2019898 - ET POLICY I2P Retrieving reseed info (policy.rules)
2020338 - ET WEB_SERVER WPScan User Agent (web_server.rules)
2020343 - ET MOBILE_MALWARE Android Syria-Twitter Checkin
(mobile_malware.rules)
2020344 - ET TROJAN ArcDoor User-Agent (ALIZER) (trojan.rules)
2020353 - ET MOBILE_MALWARE Android/SMSThief.F Banker CnC Beacon
(mobile_malware.rules)
2020363 - ET MOBILE_MALWARE Operation Pawn Storm IOS_XAGENT Checkin
(mobile_malware.rules)
2020364 - ET MOBILE_MALWARE IOS_XAGENT UA (mobile_malware.rules)
2020373 - ET TROJAN Possible DEEP PANDA C2 Activity (trojan.rules)
2020396 - ET TROJAN Win32/Rovnix.J Checkin 2 (trojan.rules)
2020431 - ET TROJAN Arid Viper APT Advtravel Campaign GET Request
(trojan.rules)
2020433 - ET TROJAN Likely Arid Viper APT Advtravel Campaign POST
(trojan.rules)
2020471 - ET TROJAN Babar POST Request (trojan.rules)
2020474 - ET TROJAN Possible Babar POST Request (trojan.rules)
2020476 - ET CURRENT_EVENTS KaiXin EK Jar URI Struct
(current_events.rules)
2020489 - ET TROJAN SuperFish CnC Beacon 1 (trojan.rules)
2020500 - ET CURRENT_EVENTS DRIVEBY Likely Evil EXE with no referer from
HFS webserver (used by Unknown EK) (current_events.rules)
2020556 - ET WEB_SERVER ATTACKER WebShell - Weevely - POSTed
(web_server.rules)
2020557 - ET WEB_SERVER ATTACKER WebShell - Weevely - Cookie
(web_server.rules)
2020572 - ET WEB_SERVER WebShell - ASPyder - File Create - POST Structure
(web_server.rules)
2020578 - ET POLICY Privdog Activation (policy.rules)
2020579 - ET POLICY Privdog Checkin (policy.rules)
2020602 - ET TROJAN LogPOS Sending Data (trojan.rules)
2020622 - ET CURRENT_EVENTS rechnung zip file download
(current_events.rules)
2809650 - ETPRO WEB_SERVER SQLMap Scan Tool User Agent (web_server.rules)
2809662 - ETPRO TROJAN Win32/Tnega.CeVIOZB Checkin (trojan.rules)
2809673 - ETPRO TROJAN Win32.Banload.bUZH Checkin (trojan.rules)
2809674 - ETPRO TROJAN Win32/Spy.Banker.aahf Checkin (trojan.rules)
2809675 - ETPRO TROJAN Trojan.Win32.Scar Checkin (trojan.rules)
2809676 - ETPRO TROJAN Win32/Gastig.A Sending Passwords via HTTP POST
(trojan.rules)
2809690 - ETPRO MOBILE_MALWARE Backdoor.AndroidOS.Pmixi.a Checkin
(mobile_malware.rules)
2809709 - ETPRO TROJAN Win32/Paskod.M HTTP Checkin (trojan.rules)
2809712 - ETPRO WEB_SPECIFIC_APPS WP Theme Platform/Pagelines RCE Attempt
(web_specific_apps.rules)
2809714 - ETPRO WEB_SPECIFIC_APPS WP Pixabay Images RFI/RCE Attempt
(web_specific_apps.rules)
2809748 - ETPRO WEB_CLIENT Possible IE XSS filter bypass (CVE-2015-0070)
(web_client.rules)
2809749 - ETPRO POLICY WebDAV request for SysVol Outbound (policy.rules)
2809751 - ETPRO MOBILE_MALWARE RiskTool.AndroidOS.SmsPay.k Checkin
(mobile_malware.rules)
2809754 - ETPRO TROJAN Win32/Murlo.E Checkin (trojan.rules)
2809777 - ETPRO WEB_SERVER MetaSploit PHP Shell Code Inbound
(web_server.rules)
2809780 - ETPRO MOBILE_MALWARE RiskTool.AndroidOS.SMSreg.ke Checkin
(mobile_malware.rules)
2809806 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Opfake.a Checkin 12
(mobile_malware.rules)
2809828 - ETPRO MOBILE_MALWARE Android/UUPAY.F Checkin
(mobile_malware.rules)
2809831 - ETPRO MOBILE_MALWARE Android.Riskware.SMSReg.R Checkin
(mobile_malware.rules)
2809837 - ETPRO MOBILE_MALWARE Android/Glooken.A Checkin
(mobile_malware.rules)
2809845 - ETPRO TROJAN Win32/Neshta.A Checkin 5 (trojan.rules)
2809853 - ETPRO TROJAN Win32/Spy.Banker.PTM Checkin (trojan.rules)
2809860 - ETPRO WEB_SPECIFIC_APPS Unsafe PHP Method in HTTP POST
(web_specific_apps.rules)
2809876 - ETPRO TROJAN Win32/Agent.WPN CnC Beacon User-Agent
(trojan.rules)
2809877 - ETPRO TROJAN Win32/Agent.WPN CnC Beacon (trojan.rules)
2809878 - ETPRO TROJAN Win32/Necurs Checkin 2 (trojan.rules)
2809890 - ETPRO TROJAN Win32/Spy.VB.NPR Checkin via HTTP (trojan.rules)
2809926 - ETPRO TROJAN Win32/TrojanProxy.Agent.AU Checkin (trojan.rules)
2809980 - ETPRO MOBILE_MALWARE RiskTool.AndroidOS.SMSreg.eg Checkin
(mobile_malware.rules)
2809983 - ETPRO TROJAN Win32.Vobfus HTTP Request (trojan.rules)
2842586 - ETPRO TROJAN Observed Unknown Doc Dropper Retrieval Domain in
TLS SNI (trojan.rules)