[***] Summary: [***]
2 new OPEN, 29 new PRO (2 + 27). Jupyter Stealer, AsyncRAT, Various Phish, Others.
Please share issues, feedback, and requests at https://feedback.emergingthreats.net/feedback
[+++] Added rules: [+++]
Open:
2017900 - ET EXPLOIT Metasploit 2013-3346 (exploit.rules)
2031233 - ET TROJAN Win32/Unk.ASNBot CnC Activity (trojan.rules)
Pro:
2845629 - ETPRO TROJAN Observed Possible Malicious SSL Cert
(AsyncRAT) (trojan.rules)
2845630 - ETPRO TROJAN Win32/Unk.FakeFlash Install Activity (trojan.rules)
2845631 - ETPRO CURRENT_EVENTS Successful Santander Phish 2020-11-24
(current_events.rules)
2845632 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 1) (trojan.rules)
2845633 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 2) (trojan.rules)
2845634 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 3) (trojan.rules)
2845635 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 4) (trojan.rules)
2845636 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 5) (trojan.rules)
2845637 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 6) (trojan.rules)
2845638 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-11-24 7) (trojan.rules)
2845639 - ETPRO CURRENT_EVENTS Successful Generic Phish 2020-11-24
(current_events.rules)
2845640 - ETPRO CURRENT_EVENTS Successful Galicia Phish 2020-11-24
(current_events.rules)
2845641 - ETPRO CURRENT_EVENTS Successful Galicia Phish 2020-11-24
(current_events.rules)
2845642 - ETPRO CURRENT_EVENTS Successful SunTrust Phish 2020-11-24
(current_events.rules)
2845643 - ETPRO CURRENT_EVENTS Successful OneDrive Phish 2020-11-24
(current_events.rules)
2845644 - ETPRO CURRENT_EVENTS Successful Generic Webmail Phish
2020-11-24 (current_events.rules)
2845645 - ETPRO CURRENT_EVENTS Successful BNP Paribas Phish
2020-11-24 (current_events.rules)
2845646 - ETPRO CURRENT_EVENTS Successful Orange FR Phish 2020-11-24
(current_events.rules)
2845647 - ETPRO CURRENT_EVENTS Successful Microsoft Account Phish
2020-11-24 (current_events.rules)
2845648 - ETPRO CURRENT_EVENTS Successful ABSA Phish 2020-11-24
(current_events.rules)
2845649 - ETPRO CURRENT_EVENTS Successful Outlook Web App Phish
2020-11-24 (current_events.rules)
2845650 - ETPRO TROJAN Win32/VB.OPL Variant Checkin via IRC (trojan.rules)
2845651 - ETPRO TROJAN Win32/Rbot.NAD Variant Checkin via IRC (trojan.rules)
2845652 - ETPRO TROJAN Win32/Detroie.A Checkin via IRC (trojan.rules)
2845653 - ETPRO INFO Clickmeter Tracking Pixel (info.rules)
2845654 - ETPRO CURRENT_EVENTS Successful Instagram Credential Phish
2020-11-24 (current_events.rules)
2845655 - ETPRO TROJAN Jupyter Stealer Activity (POST) (trojan.rules)
[///] Modified active rules: [///]
2016297 - ET CURRENT_EVENTS Malicious iframe (current_events.rules)
2016810 - ET CURRENT_EVENTS Tor2Web .onion Proxy Service SSL Cert
(2) (current_events.rules)
2019345 - ET CURRENT_EVENTS Possible CryptoLocker TorComponent DL
(current_events.rules)
2019395 - ET CURRENT_EVENTS Possible SandWorm INF Download
(current_events.rules)
2019397 - ET CURRENT_EVENTS Possible SandWorm INF Download (UNICODE)
(current_events.rules)
2019398 - ET CURRENT_EVENTS Possible SandWorm INF Download (SMB)
(current_events.rules)
2019399 - ET CURRENT_EVENTS Possible SandWorm INF Download (SMB
UNICODE) (current_events.rules)
2019714 - ET CURRENT_EVENTS Terse alphanumeric executable downloader
high likelihood of being hostile (current_events.rules)
2020622 - ET CURRENT_EVENTS rechnung zip file download (current_events.rules)
2020911 - ET CURRENT_EVENTS Likely Trojan Multi-part Macro Download
M1 (current_events.rules)
2021092 - ET CURRENT_EVENTS Download file with BITS via LNK file
(Likely Malicious) (current_events.rules)
2021312 - ET CURRENT_EVENTS Likely Malicious wininet UA Downloading
EXE (current_events.rules)
2021951 - ET CURRENT_EVENTS Possible Magento Directory Traversal
Attempt (current_events.rules)
2022050 - ET CURRENT_EVENTS Likely Evil EXE download from dotted
Quad by MSXMLHTTP M1 (current_events.rules)
2022051 - ET CURRENT_EVENTS Likely Evil EXE download from dotted
Quad by MSXMLHTTP M2 (current_events.rules)
2022053 - ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP
non-exe extension M2 (current_events.rules)
2022653 - ET CURRENT_EVENTS Likely Evil EXE download from
WinHttpRequest non-exe extension (current_events.rules)
2022841 - ET CURRENT_EVENTS Possible ReactorBot .bin Download
(current_events.rules)
2022939 - ET CURRENT_EVENTS Possible Pony DLL Download (current_events.rules)
2023754 - ET CURRENT_EVENTS Malicious JS.Nemucod to PS Dropping PE
Nov 14 M2 (current_events.rules)
2807460 - ETPRO TROJAN DDoS.Win32/Nitol.gen!A Checkin (trojan.rules)
2838496 - ETPRO TROJAN Win32/Qbot CnC Activity (trojan.rules)
2845544 - ETPRO TROJAN Observed Possible Malicious SSL Cert
(AsyncRAT) (trojan.rules)
[///] Modified inactive rules: [///]
2012504 - ET CURRENT_EVENTS Excel with Embedded .emf object
downloaded (current_events.rules)
2012646 - ET CURRENT_EVENTS Malicious JAR olig (current_events.rules)
2014038 - ET CURRENT_EVENTS MALVERTISING OpenX BrowserDetect.init
Download (current_events.rules)
2014039 - ET CURRENT_EVENTS MALVERTISING Alureon Malicious IFRAME
(current_events.rules)
2014805 - ET CURRENT_EVENTS Unknown java_ara Bin Download
(current_events.rules)
2014927 - ET CURRENT_EVENTS Unknown Java Malicious Jar /eeltff.jar
(current_events.rules)
2015024 - ET CURRENT_EVENTS Incognito - Malicious PDF Requested -
/getfile.php (current_events.rules)
2015517 - ET CURRENT_EVENTS .HTM being served from WP
1-flash-gallery Upload DIR (likely malicious) (current_events.rules)
2016298 - ET CURRENT_EVENTS Malicious iframe (current_events.rules)
2017032 - ET CURRENT_EVENTS MALVERTISING Flash - URI - /loading?vkn=
(current_events.rules)
2017546 - ET CURRENT_EVENTS Possible FortDisco POP3 Site list
download (current_events.rules)
2017628 - ET CURRENT_EVENTS Possible Sakura Jar Download Oct 22 2013
(current_events.rules)
2017660 - ET CURRENT_EVENTS Malicious Cookie Set By Flash
Malvertising (current_events.rules)
2017664 - ET CURRENT_EVENTS Fredcot campaign payload download
(current_events.rules)
2017711 - ET CURRENT_EVENTS Possible Fake Codec Download
(current_events.rules)
2018029 - ET CURRENT_EVENTS ehow/livestrong Malicious Flash 10/11
(current_events.rules)
2018086 - ET CURRENT_EVENTS Possible malicious zipped-executable
(current_events.rules)
2018103 - ET CURRENT_EVENTS TecSystems (Possible Mask) Signed PE EXE
Download (current_events.rules)
2018352 - ET CURRENT_EVENTS Possible FakeAV binary download (setup)
(current_events.rules)
2018439 - ET CURRENT_EVENTS Common Bad Actor Indicators Used in
Various Targeted 0-day Attacks (current_events.rules)
2018539 - ET CURRENT_EVENTS TorExplorer Certificate - Potentially
Linked To W32/Cryptowall.Ransomware (current_events.rules)
2018963 - ET CURRENT_EVENTS ZeroLocker EXE Download (current_events.rules)
2019595 - ET CURRENT_EVENTS FlashPack Payload Download Oct 29
(current_events.rules)
2020838 - ET CURRENT_EVENTS Malicious Doc Downloading EXE
(current_events.rules)
2021429 - ET CURRENT_EVENTS Possible IE MSMXL Detection of Local DLL
(Likely Malicious) (current_events.rules)
2021430 - ET CURRENT_EVENTS Possible IE MSMXL Detection of Local SYS
(Likely Malicious) (current_events.rules)
[---] Removed rules: [---]
2017900 - ET CURRENT_EVENTS Metasploit 2013-3346 (current_events.rules)