EveBox Rules

Latest
Rulesets
Search

Sid Allocation

Latest Suricata Rules

(from indexed sources)

Refresh
Newer
Older

Loading

Follow me on Twitter/X | Mastodon | BlueSky | Analytics --Checkout EveBox

2062493	ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (k2bsc .top)	et/open	2025-05-20
2062494	ET EXPLOIT_KIT ZPHP Domain in TLS SNI (k2bsc .top)	et/open	2025-05-20
2062461	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bubblezdjw .live)	et/open	2025-05-20
2062462	ET MALWARE Observed Win32/Lumma Stealer Related Domain (bubblezdjw .live) in TLS SNI	et/open	2025-05-20
2062463	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (caitraohvi .bet)	et/open	2025-05-20
2062464	ET MALWARE Observed Win32/Lumma Stealer Related Domain (caitraohvi .bet) in TLS SNI	et/open	2025-05-20
2062465	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (citellcagt .top)	et/open	2025-05-20
2062466	ET MALWARE Observed Win32/Lumma Stealer Related Domain (citellcagt .top) in TLS SNI	et/open	2025-05-20
2062467	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (escczlv .top)	et/open	2025-05-20
2062468	ET MALWARE Observed Win32/Lumma Stealer Related Domain (escczlv .top) in TLS SNI	et/open	2025-05-20
2062469	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (galijd .shop)	et/open	2025-05-20
2062470	ET MALWARE Observed Win32/Lumma Stealer Related Domain (galijd .shop) in TLS SNI	et/open	2025-05-20
2062471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genusbwaiw .live)	et/open	2025-05-20
2062472	ET MALWARE Observed Win32/Lumma Stealer Related Domain (genusbwaiw .live) in TLS SNI	et/open	2025-05-20
2062473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gettoknwg .life)	et/open	2025-05-20
2062474	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gettoknwg .life) in TLS SNI	et/open	2025-05-20
2062475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (haircuirfm .top)	et/open	2025-05-20
2062476	ET MALWARE Observed Win32/Lumma Stealer Related Domain (haircuirfm .top) in TLS SNI	et/open	2025-05-20
2062477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leasegjjr .digital)	et/open	2025-05-20
2062478	ET MALWARE Observed Win32/Lumma Stealer Related Domain (leasegjjr .digital) in TLS SNI	et/open	2025-05-20
2062479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (maxmtsq .bet)	et/open	2025-05-20
2062480	ET MALWARE Observed Win32/Lumma Stealer Related Domain (maxmtsq .bet) in TLS SNI	et/open	2025-05-20
2062481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moondips .bet)	et/open	2025-05-20
2062482	ET MALWARE Observed Win32/Lumma Stealer Related Domain (moondips .bet) in TLS SNI	et/open	2025-05-20
2062483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoresolfe .live)	et/open	2025-05-20
2062484	ET MALWARE Observed Win32/Lumma Stealer Related Domain (shoresolfe .live) in TLS SNI	et/open	2025-05-20
2062485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starsciw .shop)	et/open	2025-05-20
2062486	ET MALWARE Observed Win32/Lumma Stealer Related Domain (starsciw .shop) in TLS SNI	et/open	2025-05-20
2062487	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (threatqjqy .top)	et/open	2025-05-20
2062488	ET MALWARE Observed Win32/Lumma Stealer Related Domain (threatqjqy .top) in TLS SNI	et/open	2025-05-20
2062489	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trotwhvn .live)	et/open	2025-05-20
2062490	ET MALWARE Observed Win32/Lumma Stealer Related Domain (trotwhvn .live) in TLS SNI	et/open	2025-05-20
2062491	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (winterghzp .digital)	et/open	2025-05-20
2062492	ET MALWARE Observed Win32/Lumma Stealer Related Domain (winterghzp .digital) in TLS SNI	et/open	2025-05-20
2062495	ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (app .nerduptechnology .com)	et/open	2025-05-20
2062496	ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (app .nerduptechnology .com)	et/open	2025-05-20
903207115	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207114	SSLBL: Malicious SSL certificate detected (ResolverRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207113	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207112	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207111	SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207110	SSLBL: Malicious SSL certificate detected (ConnectWise C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207109	SSLBL: Malicious SSL certificate detected (ConnectWise C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207108	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207107	SSLBL: Malicious SSL certificate detected (ACRStealer C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207106	SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207105	SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207104	SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207103	SSLBL: Malicious SSL certificate detected (QuasarRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20
903207102	SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)	sslbl/ssl-fp-blacklist	2025-05-20