EveBox Rules

Latest
Rulesets
Search

Sid Allocation

Latest Suricata Rules

(from indexed sources)

Refresh
Newer
Older

Loading

Follow me on Twitter/X | Mastodon | BlueSky | Analytics --Checkout EveBox

903206305	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206306	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206314	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206315	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206327	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206328	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206329	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206330	SSLBL: Malicious SSL certificate detected (Rhadamanthys C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206331	SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206332	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206302	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206303	SSLBL: Malicious SSL certificate detected (LummaStealer C&C)	sslbl/ssl-fp-blacklist	2025-02-14
903206326	SSLBL: Malicious SSL certificate detected (Vidar C&C)	sslbl/ssl-fp-blacklist	2025-02-13
2060087	ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (fashionghana .shop)	et/open	2025-02-13
2060088	ET EXPLOIT_KIT ZPHP Domain in TLS SNI (fashionghana .shop)	et/open	2025-02-13
2060057	ET MALWARE Build Your Own Botnet CnC Exfil (POST)	et/open	2025-02-13
2060058	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (asphaltgforest .today)	et/open	2025-02-13
2060059	ET MALWARE Observed Win32/Lumma Stealer Related Domain (asphaltgforest .today in TLS SNI)	et/open	2025-02-13
2060060	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blast-hubs .com)	et/open	2025-02-13
2060061	ET MALWARE Observed Win32/Lumma Stealer Related Domain (blast-hubs .com in TLS SNI)	et/open	2025-02-13
2060062	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (blastikcn .com)	et/open	2025-02-13
2060063	ET MALWARE Observed Win32/Lumma Stealer Related Domain (blastikcn .com in TLS SNI)	et/open	2025-02-13
2060064	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (curitousminds .cyou)	et/open	2025-02-13
2060065	ET MALWARE Observed Win32/Lumma Stealer Related Domain (curitousminds .cyou in TLS SNI)	et/open	2025-02-13
2060066	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (generalmills .pro)	et/open	2025-02-13
2060067	ET MALWARE Observed Win32/Lumma Stealer Related Domain (generalmills .pro in TLS SNI)	et/open	2025-02-13
2060068	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gleefuhlcloud .top)	et/open	2025-02-13
2060069	ET MALWARE Observed Win32/Lumma Stealer Related Domain (gleefuhlcloud .top in TLS SNI)	et/open	2025-02-13
2060070	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (https://t .me/prokllumexp)	et/open	2025-02-13
2060071	ET MALWARE Observed Win32/Lumma Stealer Related Domain (https://t .me/prokllumexp in TLS SNI)	et/open	2025-02-13
2060072	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mercharena .biz)	et/open	2025-02-13
2060073	ET MALWARE Observed Win32/Lumma Stealer Related Domain (mercharena .biz in TLS SNI)	et/open	2025-02-13
2060074	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nestlecompany .pro)	et/open	2025-02-13
2060075	ET MALWARE Observed Win32/Lumma Stealer Related Domain (nestlecompany .pro in TLS SNI)	et/open	2025-02-13
2060076	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peajcefulspaces .cyou)	et/open	2025-02-13
2060077	ET MALWARE Observed Win32/Lumma Stealer Related Domain (peajcefulspaces .cyou in TLS SNI)	et/open	2025-02-13
2060078	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stormlegue .com)	et/open	2025-02-13
2060079	ET MALWARE Observed Win32/Lumma Stealer Related Domain (stormlegue .com in TLS SNI)	et/open	2025-02-13
2060080	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tecchsavvy .cyou)	et/open	2025-02-13
2060081	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tecchsavvy .cyou in TLS SNI)	et/open	2025-02-13
2060082	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wilvdflowercottage .pics)	et/open	2025-02-13
2060083	ET MALWARE Observed Win32/Lumma Stealer Related Domain (wilvdflowercottage .pics in TLS SNI)	et/open	2025-02-13
2060084	ET MALWARE SocGholish CnC Domain in DNS Lookup (portal .miaariacademy .com)	et/open	2025-02-13
2060085	ET MALWARE SocGholish CnC Domain in TLS SNI (portal .miaariacademy .com)	et/open	2025-02-13
2060055	ET WEB_SPECIFIC_APPS SonicOS SSLVPN Authentication Bypass HTTP Cookie (swap) (CVE-2024-53704)	et/open	2025-02-13
2060056	ET WEB_SPECIFIC_APPS SonicOS SSLVPN Authentication Bypass Response (CVE-2024-53704)	et/open	2025-02-13
2060086	ET WEB_SPECIFIC_APPS Palo Alto PAN-OS Management Web Interface Authentication Bypass (CVE-2025-0108)	et/open	2025-02-13
903206322	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-02-13
903206323	SSLBL: Malicious SSL certificate detected (AsyncRAT C&C)	sslbl/ssl-fp-blacklist	2025-02-13
903206324	SSLBL: Malicious SSL certificate detected (OffLoader C&C)	sslbl/ssl-fp-blacklist	2025-02-13