Rule History

SID: 2050748 • Source: et/open

Versions (2)

Version DetailsCurrent

Rev: 1 • Feb 7, 2024, 12:00 PM

Message:

ET PHISHING ResumeLooter Domain in DNS Lookup (7o .ae)

Rule:

alert dns $HOME_NET any -> any any (msg:"ET PHISHING ResumeLooter Domain in DNS Lookup (7o .ae)"; dns.query; dotprefix; content:".7o.ae"; nocase; endswith; reference:url,www.group-ib.com/blog/resumelooters/; reference:url,otx.alienvault.com/pulse/65c2755b2b9d2dfe5b6699f9; classtype:social-engineering; sid:2050748; rev:1; metadata:attack_target Client_Endpoint, created_at 2024_02_07, deployment Perimeter, malware_family ResumeLooter, confidence High, signature_severity Major, updated_at 2024_02_07;)

Created:

Feb 7, 2024, 12:00 PM

Updated:

Feb 7, 2024, 12:00 PM

DB Created:

Feb 8, 2024, 12:00 AM

DB Updated:

Feb 8, 2024, 12:00 AM

Filename:

rules/emerging-phishing.rules