[Emerging-Sigs] Daily Ruleset Update Summary 2020/05/12

Jason Williams jwilliams at emergingthreats.net
Tue May 12 13:44:58 HDT 2020


[***]            Summary:            [***]

  8 Open, 35 Pro (8 + 27). Hakbit Ransomware, Taurus Stealer, Qbot,
Sobinokibi, VaRiOuS Phishing

  Thanks: @James_inthe_box, @AdAstra247

  Please be aware that after the deprecation of our Suricata 2/3 support
(April 15th 2020), the path for downloading the last pushed production
Suricata 2/3 rulesets have changed.  Deprecated rulesets are available at
https://rules.emergingthreatspro.com/OINK/old for ETPro and
https://rules.emergingthreatspro.com/open/old/ for ETOpen.  All requests
for the Suricata 2/3 at their previous locations will now lead to the
Suricata 4.0 production rules for ETPro and the rule download instructions
for ETOpen.

  Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

 Open:

  2030155 - ET TROJAN Observed TrojanSpy.SH.HADGLIDER.A Exfil Domain in DNS
Query (trojan.rules)
  2030156 - ET TROJAN Hakbit Ransomware Exfil via FTP (trojan.rules)
  2030157 - ET TROJAN Possible Win32/Qbot/Quakbot Checkin via HTTP GET
(trojan.rules)
  2030158 - ET TROJAN Taurus Stealer CnC Host Checkin (trojan.rules)
  2030159 - ET TROJAN Taurus Stealer CnC Exfil (trojan.rules)
  2030160 - ET EXPLOIT Complaint Management System 1.0 - Authentication
Bypass Attempt (exploit.rules)
  2030161 - ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup
(corpleaks .net) (policy.rules)
  2030162 - ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup
(hxt254aygrsziejn .onion) DNS Lookup (policy.rules)

 Pro:

  2842507 - ETPRO MOBILE_MALWARE AndroidOS/AdWo.G Reporting Device/Network
Info (mobile_malware.rules)
  2842508 - ETPRO MOBILE_MALWARE Android.Styricka.GEN6212 CnC Beacon
(mobile_malware.rules)
  2842509 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.Plangton.a Checkin
(mobile_malware.rules)
  2842510 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.Boogr.gsh Checkin
(mobile_malware.rules)
  2842511 - ETPRO MOBILE_MALWARE Android.HiddadCAD.ZQ Checkin
(mobile_malware.rules)
  2842512 - ETPRO TROJAN MalDoc Request for Payload 2020-05-12
(trojan.rules)
  2842513 - ETPRO TROJAN Win32/PredatorTheThief Variant CnC Activity
(trojan.rules)
  2842514 - ETPRO TROJAN Win32/PredatorTheThief Variant CnC Exfil
(trojan.rules)
  2842515 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-12 1) (trojan.rules)
  2842516 - ETPRO TROJAN Possible More_eggs CnC Activity M2 (trojan.rules)
  2842517 - ETPRO TROJAN Hakbit Ransomware Login via FTP (trojan.rules)
  2842518 - ETPRO CURRENT_EVENTS Successful Microsoft Word Online Phish
2020-05-12 (current_events.rules)
  2842519 - ETPRO CURRENT_EVENTS Successful Adobe PDF Online Phish
2020-05-12 (current_events.rules)
  2842520 - ETPRO CURRENT_EVENTS Successful Banco do Brasil Phish
2020-05-12 (current_events.rules)
  2842521 - ETPRO CURRENT_EVENTS Successful Outlook Web Access Phish
2020-05-12 (current_events.rules)
  2842522 - ETPRO CURRENT_EVENTS Successful Ionos Phish 2020-05-12
(current_events.rules)
  2842523 - ETPRO CURRENT_EVENTS Successful Facebook Phish 2020-05-12
(current_events.rules)
  2842524 - ETPRO CURRENT_EVENTS Successful Generic Phish 2020-05-12
(current_events.rules)
  2842525 - ETPRO CURRENT_EVENTS Successful ABSA Phish 2020-05-12
(current_events.rules)
  2842526 - ETPRO CURRENT_EVENTS Successful Yahoo Phish 2020-05-12
(current_events.rules)
  2842527 - ETPRO POLICY Outbound AEScrypt V2 File Structure via TCP M1
(policy.rules)
  2842528 - ETPRO POLICY Outbound AEScrypt V2 File Structure via TCP M2
(policy.rules)
  2842529 - ETPRO POLICY Inbound AEScrypt V2 File Structure via HTTP M1
(policy.rules)
  2842530 - ETPRO POLICY Inbound AEScrypt V2 File Structure via HTTP M2
(policy.rules)
  2842531 - ETPRO POLICY Inbound AEScrypt V1 File Structure via HTTP
(policy.rules)
  2842532 - ETPRO POLICY Suspicious Inbound Cmd - LockWorkStation
(policy.rules)
  2842533 - ETPRO TROJAN Sobinokibi CnC Activity (trojan.rules)

 [///]     Modified active rules:     [///]

  2013926 - ET POLICY HTTP traffic on port 443 (POST) (policy.rules)
  2013927 - ET POLICY HTTP traffic on port 443 (HEAD) (policy.rules)
  2013928 - ET POLICY HTTP traffic on port 443 (PROPFIND) (policy.rules)
  2013931 - ET POLICY HTTP traffic on port 443 (DELETE) (policy.rules)
  2018772 - ET TROJAN Dridex/Bugat/Feodo GET Checkin (trojan.rules)
  2019239 - ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie
(web_server.rules)
  2019283 - ET TROJAN BlackEnergy POST Request (trojan.rules)
  2019331 - ET MOBILE_MALWARE iOS/Xsser Checkin (mobile_malware.rules)
  2019332 - ET MOBILE_MALWARE iOS/Xsser sending GPS info
(mobile_malware.rules)
  2019333 - ET MOBILE_MALWARE iOS/Xsser sending files (mobile_malware.rules)
  2019334 - ET MOBILE_MALWARE iOS/Xsser checking library version
(mobile_malware.rules)
  2019341 - ET TROJAN Cryptowall 2.0 DL URI Struct Oct 2 2014 (trojan.rules)
  2019366 - ET POLICY 2Downloadz.com File Sharing User-Agent (policy.rules)
  2019379 - ET TROJAN Win32/PSW.Papras.CK file upload (trojan.rules)
  2019381 - ET TROJAN Win32/Ursnif Connectivity Check (trojan.rules)
  2019478 - ET TROJAN Dridex POST Checkin (trojan.rules)
  2019498 - ET TROJAN W32/24x7Help.ScareWare CnC Beacon (trojan.rules)
  2019500 - ET TROJAN Vawtrak/NeverQuest Posting Data (trojan.rules)
  2030135 - ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup
(mazenews .top) (policy.rules)
  2030136 - ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup
(newsmaze .top) (policy.rules)
  2808896 - ETPRO EXPLOIT All In One WP Security WordPress Plugin Possible
SQL Injection Attempt (exploit.rules)
  2808903 - ETPRO EXPLOIT Nucom ADSL ADSLR5000UN ISP Credential Disclosure
Attempt (exploit.rules)
  2808904 - ETPRO EXPLOIT ZyXEL Prestig P-660HNU-T1v2 Credential Disclosure
Attempt (exploit.rules)
  2808905 - ETPRO TROJAN Win32/Xorer.O Checkin (trojan.rules)
  2808909 - ETPRO TROJAN W32/Virtumonde.OQ HTTP Client Headers
(trojan.rules)
  2808926 - ETPRO TROJAN Trojan.Win32.LaSta Checkin (trojan.rules)
  2808928 - ETPRO TROJAN Win32/Yektel.B Checkin (trojan.rules)
  2808929 - ETPRO TROJAN Win32.VirusDoctor Checkin (trojan.rules)
  2808936 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Gomal.a Checkin 2
(mobile_malware.rules)
  2808942 - ETPRO TROJAN Win32/Clisbot.A Checkin (trojan.rules)
  2808943 - ETPRO TROJAN Win32.Juched Checkin (trojan.rules)
  2808949 - ETPRO EXPLOIT Easy MailChimp Forms Plugin XSS Attempt
(exploit.rules)
  2808960 - ETPRO MOBILE_MALWARE Android.Monitor.Pdaspy.A Checkin
(mobile_malware.rules)
  2809009 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Cova.a Checkin
(mobile_malware.rules)
  2809017 - ETPRO TROJAN Win32.Pasta Variant Checkin (trojan.rules)
  2809019 - ETPRO POLICY IP Tracker online service (policy.rules)
  2809032 - ETPRO MOBILE_MALWARE Android/LoveTrap.A Checkin 3
(mobile_malware.rules)
  2809039 - ETPRO WEB_SPECIFIC_APPS Rejetto HttpFileServer RCE Check
(web_specific_apps.rules)
  2809040 - ETPRO TROJAN Win32/Vasdek Checkin (trojan.rules)
  2809048 - ETPRO MOBILE_MALWARE Android/OpFakeCL.A Checkin
(mobile_malware.rules)
  2809049 - ETPRO MOBILE_MALWARE Android.Trojan.FakeBank.G Checkin
(mobile_malware.rules)
  2809055 - ETPRO MOBILE_MALWARE Checkin to Rogue App Host
(mobile_malware.rules)
  2809064 - ETPRO MOBILE_MALWARE DroidKungFu Checkin 6
(mobile_malware.rules)
  2832193 - ETPRO TROJAN Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
(trojan.rules)
  2838432 - ETPRO TROJAN Absent/Himera Loader CnC Checkin (trojan.rules)
  2841407 - ETPRO TROJAN Win32/Vidar/Arkei/Oski Variant Retrieving Payload
(trojan.rules)

 [---]  Disabled and modified rules:  [---]

  2808805 - ETPRO TROJAN Win32/Cendelf.gen!A checkin (trojan.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20200512/cff6d395/attachment.html>


More information about the Emerging-sigs mailing list