Latest Suricata Rules - EveBox Rules

SID	Message	Source	Created
2072638	ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img3 .centovinipolska .com)	et/open	Nov 4, 2026
2072637	ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img3 .centovinipolska .com)	et/open	Nov 4, 2026
2072636	ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-cf .workersp .dev)	et/open	Nov 4, 2026
2072635	ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-connects .com)	et/open	Nov 4, 2026
2072634	ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-cf .workersp .dev)	et/open	Nov 4, 2026
2072633	ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-connects .com)	et/open	Nov 4, 2026
2072632	ET WEB_SPECIFIC_APPS Zyxel adv_remotelog.asp syslogServerAddr Parameter Command Injection Attempt (CVE-2017-18369)	et/open	Nov 3, 2026
2072631	ET WEB_SPECIFIC_APPS Zyxel tools_time.asp uiViewSNTPServer Parameter Command Injection Attempt (CVE-2017-18372)	et/open	Nov 3, 2026
2072630	ET WEB_SPECIFIC_APPS Zyxel logset.asp serverIP Parameter Command Injection Attempt (CVE-2017-18370)	et/open	Nov 3, 2026
2072629	ET MALWARE Observed Win32/Lumma Stealer Related Domain (brightqhorizons .cloud) in TLS SNI	et/open	Nov 3, 2026
2072628	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brightqhorizons .cloud)	et/open	Nov 3, 2026
2072627	ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.naughtybaptistbrewery .com domain	et/open	Nov 3, 2026
2072626	ET DYN_DNS DYNAMIC_DNS Query to a *.naughtybaptistbrewery .com domain	et/open	Nov 3, 2026
2072625	ET EXPLOIT ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg) M2	et/open	Nov 3, 2026
2072624	ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (atl-ut .cannabisrootshub .com)	et/open	Nov 2, 2026
2072623	ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (atl-ut .cannabisrootshub .com)	et/open	Nov 2, 2026
2072622	ET WEB_SPECIFIC_APPS Joomla Improper Access Control to Webservice Endpoints M2 (CVE-2023-23752)	et/open	Nov 2, 2026
2072621	ET MALWARE Observed Win32/Lumma Stealer Related Domain (rosaryconbo .fun) in TLS SNI	et/open	Nov 1, 2026
2072620	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rosaryconbo .fun)	et/open	Nov 1, 2026
2072619	ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.9dejulio .gob .ar domain	et/open	Nov 1, 2026
2072618	ET DYN_DNS DYNAMIC_DNS Query to a *.9dejulio .gob .ar domain	et/open	Nov 1, 2026
2072617	ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.chiemtinhviet .com domain	et/open	Nov 1, 2026
2072616	ET DYN_DNS DYNAMIC_DNS Query to a *.chiemtinhviet .com domain	et/open	Nov 1, 2026
2072611	ET INFO Outbound Static Websocket Key Nonce Used, Not Randomly Generated	et/open	Oct 30, 2026
2072610	ET MALWARE RedHive CnC Victim Registration M2	et/open	Oct 30, 2026
2072609	ET MALWARE RedHive CnC Screenshot Exfil	et/open	Oct 30, 2026
2072608	ET MALWARE RedHive CnC Victim Registration M1	et/open	Oct 30, 2026
2072605	ET MALWARE RedHive Related Domain in TLS SNI (mops .to)	et/open	Oct 29, 2026
2072604	ET MALWARE RedHive Related Domain in DNS Lookup (mops .to)	et/open	Oct 29, 2026
2072603	ET MALWARE RedHive Related Domain in DNS Lookup (viewgit .sbs)	et/open	Oct 29, 2026
2072602	ET MALWARE RedHive Related Domain in DNS Lookup (gitview .sbs)	et/open	Oct 29, 2026
2072601	ET MALWARE RedHive Related Domain in DNS Lookup (gitsl .xyz)	et/open	Oct 29, 2026
2072600	ET MALWARE RedHive Related Domain in DNS Lookup (gitrm .sbs)	et/open	Oct 29, 2026
2072599	ET MALWARE RedHive Related Domain in DNS Lookup (gitrm .cfd)	et/open	Oct 29, 2026
2072598	ET HUNTING X-Real-IP Header Set to localhost	et/open	Oct 29, 2026
2072597	ET HUNTING X-Client-IP Header Set to localhost	et/open	Oct 29, 2026
2072596	ET HUNTING X-Remote-IP Header Set to localhost	et/open	Oct 29, 2026
2072595	ET HUNTING X-Forwarded-Host Header Set to localhost	et/open	Oct 29, 2026
2072594	ET HUNTING X-Custom-IP-Authorization Header Set to localhost	et/open	Oct 29, 2026
2072593	ET HUNTING X-Forward-For Header Set to localhost	et/open	Oct 29, 2026
2072592	ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (universal-api .algarveexportltd .com)	et/open	Oct 29, 2026
2072591	ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (universal-api .algarveexportltd .com)	et/open	Oct 29, 2026
2072590	ET MALWARE Observed Win32/Lumma Stealer Related Domain (hollconsole .pw) in TLS SNI	et/open	Oct 29, 2026
2072589	ET MALWARE Observed Malicious Domain (krionificatronikal .com in TLS SNI)	et/open	Oct 29, 2026
2072588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hollconsole .pw)	et/open	Oct 29, 2026
2072587	ET MALWARE Observed DNS Query to Malicious Domain (krionificatronikal .com)	et/open	Oct 29, 2026
2072586	ET MALWARE Generic Rust Loader Victim HeartBeat	et/open	Oct 29, 2026
2072585	ET PHISHING Observed Phishing Domain (rsvpconnect-events .com in TLS SNI)	et/open	Oct 29, 2026
2072584	ET PHISHING Observed DNS Query to Phishing Domain (rsvpconnect-events .com)	et/open	Oct 29, 2026
2072583	ET MALWARE PolinRider Loader Typo in DNS Lookup (ethereum-rpc .publicnode .com1)	et/open	Oct 28, 2026