[Emerging-updates] Daily Ruleset Update Summary 2020/05/13

Jason Williams jwilliams at emergingthreats.net
Wed May 13 13:17:21 HDT 2020


[***]            Summary:            [***]

  3 Open, 31 Pro (3 + 28). BACKCONFIG, Valyri, Various Phishing, Suri5
Updates.

  Please be aware that after the deprecation of our Suricata 2/3 support
(April 15th 2020), the path for downloading the last pushed production
Suricata 2/3 rulesets have changed.  Deprecated rulesets are available at
https://rules.emergingthreatspro.com/OINK/old for ETPro and
https://rules.emergingthreatspro.com/open/old/ for ETOpen.  All requests
for the Suricata 2/3 at their previous locations will now lead to the
Suricata 4.0 production rules for ETPro and the rule download instructions
for ETOpen.

  Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

[+++]          Added rules:          [+++]

 Open:

  2030163 - ET TROJAN AutoHotkey Downloader Checkin via IPLogger
(trojan.rules)
  2030164 - ET MALWARE Crackswin Downloader Activity (malware.rules)
  2030165 - ET TROJAN BACKCONFIG CnC Downloader Activity (trojan.rules)

 Pro:

  2842534 - ETPRO MOBILE_MALWARE Adware.AirPush.Android.227 Reporting
Geolocation (mobile_malware.rules)
  2842535 - ETPRO MOBILE_MALWARE Android/Plankton.I Checkin
(mobile_malware.rules)
  2842536 - ETPRO TROJAN 404 Keylogger Style External IP Check
(trojan.rules)
  2842537 - ETPRO TROJAN Win32/Malex.gen!F Reporting System Info
(trojan.rules)
  2842538 - ETPRO MALWARE Win32/Unk.BoxSensor Checkin (malware.rules)
  2842539 - ETPRO INFO Suspicious Directory in URI String (wpcontent)
(info.rules)
  2842540 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound)
(trojan.rules)
  2842541 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
  2842542 - ETPRO TROJAN APT Sidewinder SystemApp CnC Host Checkin
(trojan.rules)
  2842543 - ETPRO TROJAN APT Sidewinder SystemApp CnC Document Exfiltration
(trojan.rules)
  2842544 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-13 1) (trojan.rules)
  2842545 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-13 2) (trojan.rules)
  2842546 - ETPRO TROJAN Samohacks CnC Host Checkin (trojan.rules)
  2842547 - ETPRO TROJAN Samohacks CnC Activity (trojan.rules)
  2842548 - ETPRO CURRENT_EVENTS Successful Generic Credit Card Information
Phish 2020-05-13 (current_events.rules)
  2842549 - ETPRO CURRENT_EVENTS Successful Paxful Phish 2020-05-13
(current_events.rules)
  2842550 - ETPRO CURRENT_EVENTS Successful Adobe Shared Document Phish
2020-05-13 (current_events.rules)
  2842551 - ETPRO CURRENT_EVENTS Successful Outlook Web App Phish
2020-05-13 (current_events.rules)
  2842552 - ETPRO CURRENT_EVENTS Successful Banco do Brasil Phish
2020-05-13 (current_events.rules)
  2842553 - ETPRO CURRENT_EVENTS Successful Outlook Web App Phish
2020-05-13 (current_events.rules)
  2842554 - ETPRO CURRENT_EVENTS Successful Halifax Phish 2020-05-13
(current_events.rules)
  2842555 - ETPRO TROJAN VB.Trojan.Valyri CnC Activity M1 (trojan.rules)
  2842556 - ETPRO TROJAN VB.Trojan.Valyri CnC Activity M2 (trojan.rules)
  2842557 - ETPRO TROJAN Win32/TrojanDownloader.Banload.ZIK Variant CnC
Activity (trojan.rules)
  2842558 - ETPRO TROJAN MSIL/Unk.Backdoor get_cmd Request (trojan.rules)
  2842559 - ETPRO TROJAN Win32/Remcos RAT Checkin 424 (trojan.rules)
  2842560 - ETPRO TROJAN Win32/Agent.TRU Variant Client Data Exfil M1
(trojan.rules)
  2842561 - ETPRO TROJAN Win32/Agent.TRU Variant Client Data Exfil M2
(trojan.rules)

 [///]     Modified active rules:     [///]

  2008754 - ET TROJAN Possible Rar'd Malware sent when remote host claims
to send an Image (trojan.rules)
  2013181 - ET TROJAN Ponmocup Redirection from infected Website to
Trojan-Downloader (trojan.rules)
  2013816 - ET WEB_SPECIFIC_APPS Joomla YJ Contact Local File Inclusion
Vulnerability (web_specific_apps.rules)
  2014728 - ET TROJAN Smoke Loader Checkin r=gate (trojan.rules)
  2016820 - ET TROJAN DEEP PANDA Checkin 2 (trojan.rules)
  2016821 - ET TROJAN DEEP PANDA Checkin 3 (trojan.rules)
  2018407 - ET CURRENT_EVENTS Fiesta URI Struct (current_events.rules)
  2018495 - ET WEB_SERVER Possible CVE-2014-3120 Elastic Search Remote Code
Execution Attempt (web_server.rules)
  2018964 - ET TROJAN Variant.Strictor Dropper (trojan.rules)
  2019501 - ET TROJAN Vawtrak/NeverQuest Posting Data (trojan.rules)
  2019502 - ET TROJAN Wonton-JH Checkin (trojan.rules)
  2019524 - ET WEB_SPECIFIC_APPS BASE base_stat_common.php remote file
include (web_specific_apps.rules)
  2019526 - ET WEB_SERVER WEB-PHP phpinfo access (web_server.rules)
  2019535 - ET TROJAN OLDBAIT Checkin sptr (trojan.rules)
  2019536 - ET TROJAN OLDBAIT Checkin 2 brvc (trojan.rules)
  2019537 - ET TROJAN Win32/Chopstick Checkin (APT28 Related) (trojan.rules)
  2019539 - ET TROJAN Win32/Coreshell Checkin (APT28 Related) (trojan.rules)
  2019554 - ET TROJAN Sofacy HTTP Request microsof-update.com (trojan.rules)
  2019612 - ET CURRENT_EVENTS Fiesta Flash Exploit URI Struct
(current_events.rules)
  2019624 - ET CURRENT_EVENTS Fiesta SilverLight 5.x Exploit URI Struct
(current_events.rules)
  2019630 - ET TROJAN AnubisNetworks Sinkhole HTTP Response -
195.22.26.192/26 (trojan.rules)
  2019653 - ET TROJAN Win32/Spy.Banker.ABCG Checkin (trojan.rules)
  2019654 - ET TROJAN Trojan.FakeMS Checkin (trojan.rules)
  2019660 - ET TROJAN OSX/WireLurker User-agent (globalupdate)
(trojan.rules)
  2019665 - ET TROJAN OSX/WireLurker checkin (trojan.rules)
  2019666 - ET TROJAN OSX/WireLurker HTTP Request for www.comeinbaby.com
(trojan.rules)
  2019683 - ET TROJAN Miuref/Boaxxe Checkin (trojan.rules)
  2019686 - ET EXPLOIT Belkin N750 Buffer Overflow Attempt (exploit.rules)
  2019713 - ET TROJAN Possible Asprox Pizza (trojan.rules)
  2019717 - ET TROJAN Alureon Checkin (trojan.rules)
  2019731 - ET TROJAN OSX/WireLurker HTTP Request for manhuaba.com.cn
(trojan.rules)
  2019747 - ET TROJAN ELF_BASHLITE.SMB Dropping Files (trojan.rules)
  2019754 - ET TROJAN Bamital Connectivity Check (trojan.rules)
  2019767 - ET TROJAN Rogue.Win32/FakePAV Checkin (trojan.rules)
  2019771 - ET TROJAN W32/AntiBreach Possible Activation Attempt
(trojan.rules)
  2019777 - ET TROJAN CoinVault POST M2 (trojan.rules)
  2019804 - ET WEB_SERVER PHP.//Input in HTTP POST (web_server.rules)
  2019805 - ET MOBILE_MALWARE Android.Stealthgenie Checkin
(mobile_malware.rules)
  2019821 - ET INFO WinHttpRequest (flowbits no alert) (info.rules)
  2100876 - GPL CHAT Google Talk Version Check (chat.rules)
  2101877 - GPL WEB_SERVER printenv access (web_server.rules)
  2805872 - ETPRO WEB_CLIENT RealPlayer RealMedia File Handling Buffer
Overflow (web_client.rules)
  2809071 - ETPRO TROJAN Win32.Sysn.anpg Checkin (trojan.rules)
  2809073 - ETPRO WEB_SPECIFIC_APPS HttpCombiner ASP.NET Remote File
Disclosure Request (web_specific_apps.rules)
  2809075 - ETPRO WEB_SPECIFIC_APPS vBulletin Verify Email SQL Injection
(web_specific_apps.rules)
  2809076 - ETPRO WEB_SPECIFIC_APPS vBulletin Verify Email SQL Injection
(web_specific_apps.rules)
  2809080 - ETPRO EXPLOIT DotNetNuke DNNspot Store 3.0.0 File Upload
(exploit.rules)
  2809082 - ETPRO EXPLOIT Mulesoft ESB Runtime 3.5.1 Privilege Escalation
(exploit.rules)
  2809087 - ETPRO TROJAN Trojan.Alnaddy Checkin (trojan.rules)
  2809092 - ETPRO DOS Possible XMLRPC DoS in Progress (dos.rules)
  2809093 - ETPRO MOBILE_MALWARE Android/TrojanSMS.FakeInst.FO Checkin
(mobile_malware.rules)
  2809096 - ETPRO TROJAN Win32/Derusbi.A Checkin (trojan.rules)
  2809097 - ETPRO POLICY Xunlei P2P Checkin (policy.rules)
  2809106 - ETPRO MOBILE_MALWARE Android.Trojan.Koler.C Checkin 2
(mobile_malware.rules)
  2809111 - ETPRO TROJAN Win32/CashBay Checkin (trojan.rules)
  2809112 - ETPRO USER_AGENTS Kaspersky AntiRootkit TDSSKiller User Agent
(user_agents.rules)
  2809114 - ETPRO MOBILE_MALWARE Android/Spy.Agent.DF Checkin
(mobile_malware.rules)
  2809117 - ETPRO TROJAN Win32.Scar.ibrb Checkin (trojan.rules)
  2809119 - ETPRO WEB_SPECIFIC_APPS Joomla RD Download SQL Injection
Attempt (web_specific_apps.rules)
  2809125 - ETPRO POLICY Meterpreter PHP Relay In Use (hop.php)
(policy.rules)
  2809126 - ETPRO TROJAN Win32.Yakes Variant Checkin (trojan.rules)
  2809130 - ETPRO TROJAN Win32/TrojanDownloader.Banload.UJU Checkin
(trojan.rules)
  2809139 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.cr Checkin
(mobile_malware.rules)
  2809166 - ETPRO TROJAN W32/Ransom.JD Checkin (trojan.rules)
  2809174 - ETPRO WEB_SPECIFIC_APPS Progress OpenEdge 11.2 Directory
Traversal (web_specific_apps.rules)
  2809183 - ETPRO MOBILE_MALWARE AndroidOS/SMSPay.BF Checkin
(mobile_malware.rules)
  2809202 - ETPRO TROJAN Saker Checkin (trojan.rules)
  2809203 - ETPRO TROJAN Rogue.Win32/FakePlus Checkin (trojan.rules)
  2809219 - ETPRO TROJAN Win32/Qhost.Banker.PB Checkin - SET (trojan.rules)
  2809226 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.SmForw.ak Checkin
(mobile_malware.rules)
  2809233 - ETPRO WEB_SPECIFIC_APPS CM Download Manager WP Plugin Code
Injection (web_specific_apps.rules)
  2809238 - ETPRO TROJAN Win32/Spy.Agent.OLF Retrieving CnC IP - SET
(trojan.rules)
  2809246 - ETPRO TROJAN Backdoor.Preft Checkin (trojan.rules)

 [---]  Disabled and modified rules:  [---]

  2019546 - ET TROJAN Sofacy HTTP Request adawareblock.com (trojan.rules)
  2019547 - ET TROJAN Sofacy HTTP Request adobeincorp.com (trojan.rules)
  2019548 - ET TROJAN Sofacy HTTP Request azureon-line.com (trojan.rules)
  2019549 - ET TROJAN Sofacy HTTP Request checkmalware.info (trojan.rules)
  2019550 - ET TROJAN Sofacy HTTP Request checkwinframe.com (trojan.rules)
  2019551 - ET TROJAN Sofacy HTTP Request check-fix.com (trojan.rules)
  2019552 - ET TROJAN Sofacy HTTP Request hotfix-update.com (trojan.rules)
  2019553 - ET TROJAN Sofacy HTTP Request microsofi.org (trojan.rules)
  2019555 - ET TROJAN Sofacy HTTP Request scanmalware.info (trojan.rules)
  2019556 - ET TROJAN Sofacy HTTP Request secnetcontrol.com (trojan.rules)
  2019557 - ET TROJAN Sofacy HTTP Request securitypractic.com (trojan.rules)
  2019558 - ET TROJAN Sofacy HTTP Request testservice24.net (trojan.rules)
  2019559 - ET TROJAN Sofacy HTTP Request testsnetcontrol.com (trojan.rules)
  2019560 - ET TROJAN Sofacy HTTP Request updatepc.org (trojan.rules)
  2019561 - ET TROJAN Sofacy HTTP Request updatesoftware24.com
(trojan.rules)
  2019562 - ET TROJAN Sofacy HTTP Request windows-updater.com (trojan.rules)
  2019563 - ET TROJAN Sofacy HTTP Request checkmalware.org (trojan.rules)
  2019583 - ET TROJAN Sofacy HTTP Request symanttec.org (trojan.rules)
  2019585 - ET TROJAN Sofacy HTTP Request msonlinelive.com (trojan.rules)
  2019641 - ET TROJAN Sofacy HTTP Request malwarecheck.info (trojan.rules)

 [---]         Removed rules:         [---]

  2841015 - ETPRO TROJAN ELF/Mirai User-Agent Observed (Outbound)
(trojan.rules)
  2841016 - ETPRO SCAN ELF/Mirai User-Agent Observed (Inbound) (scan.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-updates/attachments/20200513/e89aad23/attachment-0001.html>


More information about the Emerging-updates mailing list