[Emerging-updates] Daily Ruleset Update Summary 2020/05/14

Jason Williams jwilliams at emergingthreats.net
Thu May 14 14:05:56 HDT 2020


[***]            Summary:            [***]

  2 Open, 27 Pro (2 + 25). Lockbit Ransomware, Beko-S, Telegram Exfil,
Various Phishing, Suri5 Updates.

  Please be aware that after the deprecation of our Suricata 2/3 support
(April 15th 2020), the path for downloading the last pushed production
Suricata 2/3 rulesets have changed.  Deprecated rulesets are available at
https://rules.emergingthreatspro.com/OINK/old for ETPro and
https://rules.emergingthreatspro.com/open/old/ for ETOpen.  All requests
for the Suricata 2/3 at their previous locations will now lead to the
Suricata 4.0 production rules for ETPro and the rule download instructions
for ETOpen.

  Please share issues, feedback, and requests at
https://feedback.emergingthreats.net/feedback

 [+++]          Added rules:          [+++]

 Open:

  2030166 - ET POLICY HTTP Request to Lockbit Ransomware Payment Domain
(policy.rules)
  2030167 - ET EXPLOIT Possible Netlink XPON 1GE Remote Command Execution
Attempt (exploit.rules)

 Pro:

  2842562 - ETPRO INFO EXE Request to DuckDNS DynDNS Domain (info.rules)
  2842563 - ETPRO INFO EXE Request to NOIP DynDNS Domain (info.rules)
  2842564 - ETPRO INFO DNS Request to Unusually Long DuckDNS DynDNS Domain
(info.rules)
  2842565 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-14 1) (trojan.rules)
  2842566 - ETPRO TROJAN CoinMiner Known Malicious Stratum Authline
(2020-05-14 2) (trojan.rules)
  2842567 - ETPRO CURRENT_EVENTS Successful Apple Phish 2020-05-14
(current_events.rules)
  2842568 - ETPRO CURRENT_EVENTS Successful Apple Phish 2020-05-14
(current_events.rules)
  2842569 - ETPRO CURRENT_EVENTS Successful Singapore Airlines Phish
2020-05-14 (current_events.rules)
  2842570 - ETPRO CURRENT_EVENTS Successful Netflix Phish 2020-05-14
(current_events.rules)
  2842571 - ETPRO CURRENT_EVENTS Successful TSB Phish 2020-05-14
(current_events.rules)
  2842572 - ETPRO CURRENT_EVENTS Successful TSB Phish 2020-05-14
(current_events.rules)
  2842573 - ETPRO CURRENT_EVENTS Successful Credit Agricole Phish
2020-05-14 (current_events.rules)
  2842574 - ETPRO TROJAN Observed IXWARE Domain in TLS SNI (trojan.rules)
  2842575 - ETPRO TROJAN Win32/PSW.Agent.OJT Variant Exfil Via Telegram
(trojan.rules)
  2842576 - ETPRO TROJAN Win32/PSW.Agent.OJT Variant Exfil via Telegram
Response (trojan.rules)
  2842577 - ETPRO TROJAN Beko-S Bot Checkin via Discord (trojan.rules)
  2842578 - ETPRO TROJAN Win32/Remcos RAT Checkin 425 (trojan.rules)
  2842579 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842580 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842581 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842582 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842583 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842584 - ETPRO TROJAN Observed IcedID CnC Domain in TLS SNI
(trojan.rules)
  2842585 - ETPRO TROJAN Unknown Doc Dropper Retrieval (trojan.rules)
  2842586 - ETPRO TROJAN Observed unknown Doc Dropper Retrieval Domain in
TLS SNI (trojan.rules)

 [///]     Modified active rules:     [///]

  2013937 - ET WEB_SERVER Weevely PHP backdoor detected (system() function
used) (web_server.rules)
  2013939 - ET WEB_SERVER Weevely PHP backdoor detected (shell_exec()
function used) (web_server.rules)
  2013940 - ET WEB_SERVER Weevely PHP backdoor detected (proc_open()
function used) (web_server.rules)
  2013941 - ET WEB_SERVER Weevely PHP backdoor detected (popen() function
used) (web_server.rules)
  2013944 - ET WEB_SERVER Weevely PHP backdoor detected (perl->system()
function used) (web_server.rules)
  2013945 - ET WEB_SERVER Weevely PHP backdoor detected (exec() function
used) (web_server.rules)
  2018277 - ET DOS Possible WordPress Pingback DDoS in Progress (Inbound)
(dos.rules)
  2019201 - ET TROJAN Backdoor.Win32/PcClient.AA Checkin (trojan.rules)
  2019824 - ET TROJAN W32/Hyteod.Downloader CnC Beacon (trojan.rules)
  2019825 - ET POLICY Cryptexplorer API Check - Potential CoinMiner Traffic
(policy.rules)
  2019826 - ET TROJAN W32/Coinminer.Backdoor CnC Beacon (trojan.rules)
  2019827 - ET TROJAN W32/Wadolin.Downloader CnC Beacon (trojan.rules)
  2019830 - ET TROJAN Dridex v2 POST Checkin (trojan.rules)
  2019880 - ET WEB_SERVER Double Encoded Characters in URI (../)
(web_server.rules)
  2019899 - ET WEB_SERVER Insomnia Shell HTTP Request (web_server.rules)
  2019903 - ET WEB_SPECIFIC_APPS Pandora FMS SQLi (web_specific_apps.rules)
  2019947 - ET TROJAN W32/TRCrypt.ULPM Downloader CnC Beacon (trojan.rules)
  2019951 - ET WEB_SERVER MorXploit Shell Command (web_server.rules)
  2019959 - ET MOBILE_MALWARE CoolReaper CnC Beacon 2 (mobile_malware.rules)
  2019960 - ET MOBILE_MALWARE CoolReaper User-Agent (mobile_malware.rules)
  2019961 - ET TROJAN Win32/Spy.Banker.AAXV Retrieving key from Pinterest
(trojan.rules)
  2019963 - ET SCAN Acunetix Accept HTTP Header detected scan in progress
(scan.rules)
  2019985 - ET TROJAN Tendrit CnC Beacon 1 (trojan.rules)
  2019986 - ET TROJAN Tendrit CnC Beacon 2 (trojan.rules)
  2020090 - ET TROJAN Trojan.Generic.5325921 Checkin (trojan.rules)
  2020092 - ET WEB_SPECIFIC_APPS ManageEngine Desktop Central Administrator
Account Creation (web_specific_apps.rules)
  2020097 - ET WEB_SERVER ATTACKER WebShell - 1337w0rm - cPanel Cracker
(web_server.rules)
  2020101 - ET EXPLOIT Possible Misfortune Cookie RomPager Server banner
(exploit.rules)
  2020102 - ET WEB_SERVER PHP System Command in HTTP POST (web_server.rules)
  2020105 - ET POLICY Possible IP Check ip-addr.es (policy.rules)
  2020106 - ET POLICY Possible IP Check curlmyip.com (policy.rules)
  2020156 - ET TROJAN Win32/Emotet.C Checkin (trojan.rules)
  2020157 - ET TROJAN Win32/Emotet.C Variant Checkin (trojan.rules)
  2020172 - ET TROJAN Known Sinkhole Response Header CERT.PL (trojan.rules)
  2020198 - ET TROJAN Filename svchost.exe Download - Common Hostile
Filename (trojan.rules)
  2020199 - ET TROJAN Filename explorer.exe Download - Common Hostile
Filename (trojan.rules)
  2020200 - ET TROJAN Filename hkcmd.exe Download - Common Hostile Filename
(trojan.rules)
  2020201 - ET TROJAN Filename server.exe Download - Common Hostile
Filename (trojan.rules)
  2020202 - ET POLICY Terse Named Filename EXE Download - Possibly Hostile
(policy.rules)
  2020233 - ET TROJAN CryptoWall CryptoWall 3.0 Check-in (trojan.rules)
  2020237 - ET TROJAN Inception APT malware (trojan.rules)
  2020241 - ET TROJAN Backdoor.TurlaCarbon.A C2 HTTP Request (trojan.rules)
  2020294 - ET TROJAN W32/Upatre.Downloader Encoded Binary Download Request
(trojan.rules)
  2020298 - ET TROJAN Win32/Scieron-A UA (HTClient) (trojan.rules)
  2020299 - ET TROJAN Win32/Scieron-A Checkin via HTTP POST (trojan.rules)
  2025087 - ET TROJAN Vawtrak/NeverQuest Posting Data (trojan.rules)
  2025088 - ET TROJAN Vawtrak/NeverQuest Posting Data (trojan.rules)
  2030163 - ET TROJAN AutoHotkey Downloader Checkin via IPLogger
(trojan.rules)
  2803989 - ETPRO TROJAN Win32/Zegost.L Checkin (trojan.rules)
  2806027 - ETPRO TROJAN Win32/Aybo.A Checkin (trojan.rules)
  2807733 - ETPRO MOBILE_MALWARE Android/TrojanSMS.FakeInst.CG Checkin
(mobile_malware.rules)
  2807972 - ETPRO MALWARE Win32/FlyStudio Activity (malware.rules)
  2807995 - ETPRO MOBILE_MALWARE Android.Trojan.SmsSpy.BS Checkin
(mobile_malware.rules)
  2808927 - ETPRO TROJAN Trojan/Banker.Agent.bof Checkin 2 (trojan.rules)
  2808937 - ETPRO EXPLOIT revslider_show_image Plugin Local File Inclusion
Exploit Attempt (exploit.rules)
  2809241 - ETPRO TROJAN Carbanak APT Checkin (trojan.rules)
  2809248 - ETPRO WEB_SPECIFIC_APPS SP Client Document Manager WP Plugin
SQLi (web_specific_apps.rules)
  2809252 - ETPRO TROJAN W32/Tepfer.InfoStealer Dropping Files
(trojan.rules)
  2809253 - ETPRO WEB_SPECIFIC_APPS Centreon 2.5.3 and Below RCE
(web_specific_apps.rules)
  2809259 - ETPRO WEB_SPECIFIC_APPS wpDataTables 1.5.3 Plugin SQLi
(web_specific_apps.rules)
  2809260 - ETPRO WEB_SPECIFIC_APPS wpDataTables 1.5.3 Possible Shell
Upload (web_specific_apps.rules)
  2809264 - ETPRO TROJAN Win32/Kryptik.CPYA Checkin (trojan.rules)
  2809274 - ETPRO TROJAN Win32/Belot Checkin (trojan.rules)
  2809282 - ETPRO TROJAN Wauchos.AO/Andromeda Checkin 2 (trojan.rules)
  2809288 - ETPRO TROJAN Win32/Rethed.B Checkin (trojan.rules)
  2809325 - ETPRO TROJAN Win32/Bagle.L Checkin (trojan.rules)
  2809333 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.FakeInst.a Checkin 9
(mobile_malware.rules)
  2809335 - ETPRO TROJAN Oberon Logger Checkin (trojan.rules)
  2809337 - ETPRO TROJAN Win32/TrojanDownloader.Autoit.NTF Checkin
(trojan.rules)
  2809353 - ETPRO WEB_SPECIFIC_APPS Download Manager WP Plugin RCE Attempt
(web_specific_apps.rules)
  2809354 - ETPRO TROJAN SoakSoak Malware Checkin (trojan.rules)
  2809356 - ETPRO TROJAN Win32/Locker.Nikifer Checkin (trojan.rules)
  2809360 - ETPRO TROJAN Win32.Staser.aqkw Checkin (trojan.rules)
  2809365 - ETPRO WEB_SPECIFIC_APPS E-Journal SQLi Attempt
(web_specific_apps.rules)
  2809366 - ETPRO WEB_SPECIFIC_APPS ProjectSend Shell Upload Exploit
Attempt (web_specific_apps.rules)
  2809369 - ETPRO TROJAN Dyre HTTP Request Headers (trojan.rules)
  2809370 - ETPRO TROJAN Dyre Credentials POST (trojan.rules)
  2809381 - ETPRO WEB_SPECIFIC_APPS Codiad LFI Attempt
(web_specific_apps.rules)
  2809431 - ETPRO EXPLOIT WP DB Backup Plugin Database Backup Download
Exploit Attempt (exploit.rules)
  2809432 - ETPRO EXPLOIT tnftp_savefile CVE-2014-8517 Exploit Attempt
Request (exploit.rules)
  2809433 - ETPRO EXPLOIT tnftp_savefile CVE-2014-8517 Exploit Attempt
Response (exploit.rules)
  2809435 - ETPRO TROJAN Worm.MSIL.Mafusc.A Checkin (trojan.rules)
  2809439 - ETPRO TROJAN KrakenRAT CnC Beacon 1 (trojan.rules)
  2809440 - ETPRO TROJAN KrakenRAT CnC Beacon 2 (trojan.rules)
  2809443 - ETPRO USER_AGENTS NateOn User Agent Likely Hostile
(user_agents.rules)
  2809445 - ETPRO TROJAN Win32/Cuepilini.A Checkin (trojan.rules)
  2809449 - ETPRO TROJAN Win32/Induc.A Checkin 2 (trojan.rules)
  2809451 - ETPRO MOBILE_MALWARE Android/AdDisplay.AirPush.M Checkin
(mobile_malware.rules)
  2809453 - ETPRO MOBILE_MALWARE Trojan.AndroidOS.Abmnger.a Checkin
(mobile_malware.rules)
  2809458 - ETPRO TROJAN Backdoor.Locobad.B Checkin (trojan.rules)
  2809518 - ETPRO MOBILE_MALWARE Trojan-SMS.AndroidOS.Agent.az Checkin 2
(mobile_malware.rules)
  2809528 - ETPRO TROJAN Win32/Lightbulb.A Checkin (trojan.rules)
  2809551 - ETPRO TROJAN WIN.TROJAN.TWERKET Checkin (trojan.rules)
  2809552 - ETPRO MOBILE_MALWARE Android Backdoor PoisonCake Checkin
(mobile_malware.rules)
  2809565 - ETPRO MOBILE_MALWARE Android.Riskware.SmsPay.AO Checkin 4
(mobile_malware.rules)
  2809574 - ETPRO TROJAN Mal/Banker-EV CnC Beacon (trojan.rules)
  2809586 - ETPRO TROJAN Win32/Neshta.A Checkin 4 (trojan.rules)
  2809605 - ETPRO P2P uTorrent Hydra Client (p2p.rules)
  2809626 - ETPRO TROJAN SiR-DoOoM worm User-Agent (trojan.rules)
  2809627 - ETPRO TROJAN KJw0rm User-Agent (trojan.rules)
  2809628 - ETPRO TROJAN SiR-DoOoM worm CnC Beacon (trojan.rules)
  2809629 - ETPRO TROJAN KJw0rm CnC Beacon (trojan.rules)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-updates/attachments/20200514/f7f3a56e/attachment-0001.html>


More information about the Emerging-updates mailing list