[Emerging-Sigs] Daily Ruleset Update Summary 2020/04/23

Brandon Murphy bmurphy at emergingthreats.net
Thu Apr 23 13:36:54 HDT 2020


***]            Summary:            [***]

 19 new Open, 45 new Pro (19 + 26). METALJACK, iOS MobileMail Exploit,
PoetRAT, Zebrocy, Various Phishing.

 Thanks @james_inthe_box

 Many rules in the Suricata 5 ruleset have been updated with Suricata 5
rule syntax/keywords. A complete list of rules that were changed can be
found via the changelog here:

https://rules.emergingthreats.net/changelogs/suricata-5.0-enhanced.etpro.2020-04-23T22:22:47.txt

 Please be aware that after the deprecation of our Suricata 2/3 support
(April 15th 2020), the path for downloading the last pushed production
Suricata 2/3 rulesets have changed.  Deprecated rulesets are available at
https://rules.emergingthreatspro.com/OINK/old for ETPro and
https://rules.emergingthreatspro.com/open/old/ for ETOpen.  All requests
for the Suricata 2/3 at their previous locations will now lead to the
Suricata 4.0 production rules for ETPro and the rule download instructions
for ETOpen.

 Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

Open:

  2029996 - ET TROJAN NanoCore RAT CnC 27 (trojan.rules)
  2029997 - ET TROJAN METALJACK APT32 CnC Host Checkin (trojan.rules)
  2029998 - ET TROJAN METALJACK APT32 DNS Lookup (m.topiccore.com)
(trojan.rules)
  2029999 - ET TROJAN METALJACK APT32 DNS Lookup (jcdn.jsoid.com)
(trojan.rules)
  2030000 - ET TROJAN METALJACK APT32 DNS Lookup (libjs.inquirerjs.com)
(trojan.rules)
  2030001 - ET TROJAN METALJACK APT32 DNS Lookup (vitlescaux.com)
(trojan.rules)
  2030002 - ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)
(trojan.rules)
  2030003 - ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)
(trojan.rules)
  2030004 - ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)
(trojan.rules)
  2030005 - ET TROJAN SSL/TLS Certificate Observed (APT32 METALJACK)
(trojan.rules)
  2030006 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030007 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030008 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030009 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030010 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030011 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030012 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030013 - ET CURRENT_EVENTS Possible iOS MobileMail OOB Write/Heap
Overflow Exploit Email (Inbound) (current_events.rules)
  2030014 - ET TROJAN Observed DNS Query to Malvertising Related Domain
(trojan.rules)

Pro:

  2842148 - ETPRO TROJAN Observed Malicious SSL Cert (Cobalt Strike)
(trojan.rules)
  2842149 - ETPRO TROJAN Observed Malicious SSL Cert (Cobalt Strike)
(trojan.rules)
  2842150 - ETPRO TROJAN Observed Win32/Emelent.B!cl User-Agent
(trojan.rules)
  2842151 - ETPRO TROJAN Observed DNS Query to MUDDYWATER CnC Domain
(trojan.rules)
  2842152 - ETPRO TROJAN Win32/Kryptik.GGXP.UNKRAT CnC Checkin
(trojan.rules)
  2842153 - ETPRO TROJAN Observed DNS Query to MUDDYWATER CnC Domain
(trojan.rules)
  2842154 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-23 1) (trojan.rules)
  2842155 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-04-23 2) (trojan.rules)
  2842156 - ETPRO TROJAN Zebrocy Screenshot Upload (trojan.rules)
  2842157 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-04-23 (current_events.rules)
  2842158 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-04-23
(current_events.rules)
  2842159 - ETPRO CURRENT_EVENTS Successful Dropbox Phish 2020-04-23
(current_events.rules)
  2842160 - ETPRO CURRENT_EVENTS Successful Yahoo Phish 2020-04-23
(current_events.rules)
  2842161 - ETPRO CURRENT_EVENTS Successful Banco do Brasil Phish
2020-04-23 (current_events.rules)
  2842162 - ETPRO CURRENT_EVENTS Successful Banco do Brasil Phish
2020-04-23 (current_events.rules)
  2842163 - ETPRO CURRENT_EVENTS Successful Bancolumbia Phish 2020-04-23
(current_events.rules)
  2842164 - ETPRO CURRENT_EVENTS Successful Bancolumbia Phish 2020-04-23
(current_events.rules)
  2842165 - ETPRO CURRENT_EVENTS Successful ABSA Phish 2020-04-23
(current_events.rules)
  2842166 - ETPRO CURRENT_EVENTS Successful Facebook Phish 2020-04-23
(current_events.rules)
  2842167 - ETPRO CURRENT_EVENTS Successful Lloyds Bank Phish 2020-04-23
(current_events.rules)
  2842168 - ETPRO TROJAN Win32/Agent.RZA CnC Host Checkin (trojan.rules)
  2842169 - ETPRO TROJAN Possible PoetRAT FTP Connection (trojan.rules)
  2842170 - ETPRO TROJAN PoetRAT Screenshot Upload (trojan.rules)
  2842171 - ETPRO TROJAN Win32/Spy.Socelars.AD Variant CnC Activity
(trojan.rules)
  2842172 - ETPRO TROJAN Observed Malicious SSL Cert (Ursnif CnC)
(trojan.rules)
  2842173 - ETPRO TROJAN Observed Malicious SSL Cert (AZORult CnC)
(trojan.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20200423/d8be2ec1/attachment.html>


More information about the Emerging-sigs mailing list