[***] Summary: [***]

18 new OPEN, 20 new PRO (18 + 2). Various Exploit, Antinum, Aurora
Stealer and others.

Thanks @0xrb, @ViriBack, @DuskRiseInc, @_CPResearch_, NoahWolf

The Emerging Threats mailing list is migrating to Discourse. Please
visit us at https://community.emergingthreats.net

We will announce the mailing list retirement date in the near future.

[+++] Added rules: [+++]

Open:

2043008 - ET ADWARE_PUP Win32/Atshz.A Checkin (adware_pup.rules)
2043009 - ET ADWARE_PUP Win32/Atshz.A Checkin M2 (adware_pup.rules)
2043010 - ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M1
(CVE-2022-46169) (exploit.rules)
2043011 - ET EXPLOIT Possible Cacti Unauthenticated RCE Inbound M2
(CVE-2022-46169) (exploit.rules)
2043012 - ET MALWARE Antinum WebSockets Start (malware.rules)
2043013 - ET MALWARE Antinum HTTP Checkin (malware.rules)
2043014 - ET MALWARE Win32/Drokbk Checkin Activity (GET) (malware.rules)
2043015 - ET MALWARE CloudAtlas APT Related Domain in DNS Lookup
(malware.rules)
2043016 - ET MALWARE CloudAtlas APT Related Domain in DNS Lookup
(malware.rules)
2043017 - ET MALWARE Aurora Stealer Admin Console In HTTP Response
(malware.rules)
2043018 - ET MALWARE Observed DNS Query to Alibaba2044 Domain
(service-fatturecloud .de) (malware.rules)
2043019 - ET MALWARE Observed DNS Query to Alibaba2044 Domain
(utente .service-fatturecloud .de) (malware.rules)
2043020 - ET MALWARE Observed DNS Query to Alibaba2044 Domain
(downloadpdf-fattura .de) (malware.rules)
2043021 - ET PHISHING Facebook Credential Phish Landing Page
2022-12-27 (phishing.rules)
2043022 - ET PHISHING Generic Credential Phish Landing Page
2022-12-27 (phishing.rules)
2043023 - ET MALWARE TA444/Lazarus Related Domain in DNS Lookup
(thedoodles .site) (malware.rules)
2043024 - ET MALWARE SocGholish Domain in DNS Lookup (people
.fl2wealth .com) (malware.rules)
2043025 - ET MALWARE SocGholish Domain in DNS Lookup (taxes .rpacx
.com) (malware.rules)

Pro:

2852982 - ETPRO PHISHING Twitter Phish Landing Page 2022-12-23
(phishing.rules)
2852983 - ETPRO PHISHING Successful Twitter Credential Phish
2022-12-23 (phishing.rules)

[///] Modified active rules: [///]

2810290 - ETPRO MALWARE NanoCore RAT Keepalive Response 1 (malware.rules)

[---] Removed rules: [---]

2042766 - ET INFO localtunnel Tunneling Domain in DNS Lookup
(localtunnel .me) (info.rules)
2830630 - ETPRO ADWARE_PUP Win32/Atshz.A Checkin (adware_pup.rules)
2830631 - ETPRO ADWARE_PUP Win32/Atshz.A Checkin M2 (adware_pup.rules)

Date:
Summary title:
18 new OPEN, 20 new PRO (18 + 2). Various Exploit, Antinum, Aurora Stealer and others.