[Emerging-updates] Daily Ruleset Update Summary 2020/03/31

Jack Mott jmott at emergingthreats.net
Tue Mar 31 15:39:25 HDT 2020


[***]            Summary:            [***]

16 new Open, 42 new Pro (16 + 26). Various Possible COVID-19 Based
Phish/Spam, Cobalt Strike, Android/Trojan-Spy.AndroidOS.SpyNote.d,
Win32/Vendetta Backdoor, Bandook, Remcos, VARIOUS PHISHING.

Tks: @James_inthe_box, @_scrapbird

Suricata 2/3 Support from Emerging Threats will be become End-Of-Life on
April 15th, 2020.

Suricata 2/3 EOL information:
https://lists.emergingthreats.net/pipermail/emerging-updates/2019-October/004655.html


[+++]          Added rules:          [+++]

Open:

  2029753 - ET INFO Suspicious GET Request with Possible COVID-19 URI M1
(info.rules)
  2029766 - ET TROJAN Observed DNS Query to Stitch C2 Domain (trojan.rules)
  2029767 - ET TROJAN Observed DNS Query to Stitch C2 Domain (trojan.rules)
  2029768 - ET TROJAN Buer Loader Update Request (trojan.rules)
  2029769 - ET SCAN Mirai Variant User-Agent (Inbound) (scan.rules)
  2029770 - ET TROJAN Mirai Variant User-Agent (Outbound) (trojan.rules)
  2029771 - ET USER_AGENTS Shadowcoin Cryptocurrency UA Observed
(user_agents.rules)
  2029772 - ET USER_AGENTS Willowcoin Cryptocurrency UA Observed
(user_agents.rules)
  2029773 - ET TROJAN Win32/Tofsee Covid19 Spam Template 1 Active -
Outbound Email Spam (trojan.rules)
  2029774 - ET TROJAN Win32/Tofsee Malformed Spam Template String
(trojan.rules)
  2029775 - ET TROJAN Win32/Tofsee Unique Email Body Byte Sequence Observed
(trojan.rules)
  2029777 - ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound
M2 (current_events.rules)
  2029778 - ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound
M3 (current_events.rules)
  2029779 - ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound
M4 (current_events.rules)
  2029780 - ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound
M5 (current_events.rules)
  2029781 - ET CURRENT_EVENTS Possible Covid19 Themed Email Spam Outbound
M6 (current_events.rules)

Pro:

  2841778 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SpyNote.d Keep Alive
(mobile_malware.rules)
  2841779 - ETPRO TROJAN Cobalt Strike Malleable C2 (jquery Profile)
(trojan.rules)
  2841780 - ETPRO TROJAN Win32/Vendetta Backdoor CnC Checkin (trojan.rules)
  2841781 - ETPRO TROJAN Win32/Vendetta Backdoor CnC Activity (trojan.rules)
  2841782 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-03-31 1) (trojan.rules)
  2841783 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-03-31 2) (trojan.rules)
  2841784 - ETPRO TROJAN MSIL/Agent.BV Variant CnC Host Checkin
(trojan.rules)
  2841785 - ETPRO TROJAN MSIL/Agent.BV Variant CnC Exfil (trojan.rules)
  2841786 - ETPRO CURRENT_EVENTS Successful Microsoft Excel Phish
2020-03-31 (current_events.rules)
  2841787 - ETPRO CURRENT_EVENTS Successful Paypal FR Phish 2020-03-31
(current_events.rules)
  2841788 - ETPRO CURRENT_EVENTS Successful Chase Phish 2020-03-31
(current_events.rules)
  2841789 - ETPRO CURRENT_EVENTS Successful Banco Itau Phish 2020-03-31
(current_events.rules)
  2841790 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-03-31 (current_events.rules)
  2841791 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-03-31 (current_events.rules)
  2841792 - ETPRO CURRENT_EVENTS Successful Match Phish 2020-03-31
(current_events.rules)
  2841793 - ETPRO CURRENT_EVENTS Successful First Bank Phish 2020-03-31
(current_events.rules)
  2841794 - ETPRO CURRENT_EVENTS Successful Santander Phish 2020-03-31
(current_events.rules)
  2841795 - ETPRO CURRENT_EVENTS Successful Santander Phish 2020-03-31
(current_events.rules)
  2841796 - ETPRO CURRENT_EVENTS Successful Microsoft Account Phish
2020-03-31 (current_events.rules)
  2841797 - ETPRO CURRENT_EVENTS Successful Generic Email Verification
Phish 2020-03-31 (current_events.rules)
  2841798 - ETPRO CURRENT_EVENTS Successful CIBC Phish 2020-03-31
(current_events.rules)
  2841799 - ETPRO TROJAN Win32/Remcos RAT Checkin 379 (trojan.rules)
  2841800 - ETPRO TROJAN Observed Malicious SSL Cert (Ursnif CnC)
(trojan.rules)
  2841801 - ETPRO TROJAN Observed Malicious SSL Cert (AZORult CnC)
(trojan.rules)
  2841802 - ETPRO TROJAN Suspected Bandook CnC (trojan.rules)
  2841803 - ETPRO TROJAN Suspected Bandook CnC Response (trojan.rules)

 [///]     Modified active rules:     [///]

  2816365 - ETPRO TROJAN W32.SOCKSBOT CnC Request (trojan.rules)
  2816366 - ETPRO TROJAN W32.SOCKSBOT CnC Response (trojan.rules)
  2816367 - ETPRO POLICY Suspicious 404 OK Response (policy.rules)
  2816739 - ETPRO TROJAN Rexpot Retrieving Payload - set 1 (trojan.rules)
  2816808 - ETPRO CURRENT_EVENTS RIG EK Flash Exploit Mar 29 2016
(current_events.rules)
  2816860 - ETPRO TROJAN Salam Ransomware CnC Checkin (trojan.rules)
  2816901 - ETPRO MALWARE Win32/Shouqu Checkin (malware.rules)
  2819648 - ETPRO CURRENT_EVENTS SunDown/Xer Payload (URL Primer)
(current_events.rules)
  2841722 - ETPRO CURRENT_EVENTS Successful Generic Phish 2020-03-26
(current_events.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-updates/attachments/20200331/7a02c4dc/attachment.html>


More information about the Emerging-updates mailing list