Back to Rule

Rule History

SID: 2527019 • Source: et/open

Versions (145)

Rev: 1621
May 29, 2026, 8:35 PM
Current
Rev: 1620
May 28, 2026, 9:09 PM
Archived
Rev: 1619
May 27, 2026, 9:21 PM
Archived
Rev: 1618
May 26, 2026, 8:12 PM
Archived
Rev: 1614
May 22, 2026, 8:34 PM
Archived
Rev: 1613
May 21, 2026, 9:34 PM
Archived
Rev: 1612
May 20, 2026, 8:35 PM
Archived
Rev: 1611
May 19, 2026, 8:34 PM
Archived
Rev: 1610
May 18, 2026, 9:34 PM
Archived
Rev: 1607
May 15, 2026, 8:34 PM
Archived
Rev: 1606
May 14, 2026, 10:34 PM
Archived
Rev: 1605
May 13, 2026, 9:35 PM
Archived
Rev: 1604
May 12, 2026, 9:34 PM
Archived
Rev: 1603
May 11, 2026, 9:35 PM
Archived
Rev: 1600
May 8, 2026, 9:35 PM
Archived
Rev: 1599
May 7, 2026, 8:34 PM
Archived
Rev: 1598
May 6, 2026, 9:34 PM
Archived
Rev: 1597
May 5, 2026, 9:34 PM
Archived
Rev: 1596
May 4, 2026, 8:35 PM
Archived
Rev: 1593
May 1, 2026, 8:34 PM
Archived
Rev: 1592
Apr 30, 2026, 9:34 PM
Archived
Rev: 1591
Apr 29, 2026, 9:34 PM
Archived
Rev: 1590
Apr 28, 2026, 8:35 PM
Archived
Rev: 1589
Apr 27, 2026, 10:34 PM
Archived
Rev: 1586
Apr 24, 2026, 8:35 PM
Archived
Rev: 1585
Apr 23, 2026, 9:34 PM
Archived
Rev: 1584
Apr 22, 2026, 9:34 PM
Archived
Rev: 1583
Apr 21, 2026, 9:34 PM
Archived
Rev: 1582
Apr 20, 2026, 9:34 PM
Archived
Rev: 1579
Apr 17, 2026, 9:34 PM
Archived
Rev: 1578
Apr 16, 2026, 9:34 PM
Archived
Rev: 1577
Apr 15, 2026, 9:34 PM
Archived
Rev: 1576
Apr 14, 2026, 9:34 PM
Archived
Rev: 1575
Apr 13, 2026, 9:34 PM
Archived
Rev: 1572
Apr 10, 2026, 6:35 PM
Archived
Rev: 1571
Apr 9, 2026, 9:35 PM
Archived
Rev: 1570
Apr 8, 2026, 9:34 PM
Archived
Rev: 1569
Apr 7, 2026, 8:34 PM
Archived
Rev: 1568
Apr 6, 2026, 9:34 PM
Archived
Rev: 1567
Apr 2, 2026, 9:34 PM
Archived
Rev: 1566
Apr 1, 2026, 9:34 PM
Archived
Rev: 1565
Mar 31, 2026, 9:35 PM
Archived
Rev: 1564
Mar 30, 2026, 9:34 PM
Archived
Rev: 1561
Mar 27, 2026, 8:34 PM
Archived
Rev: 1560
Mar 26, 2026, 8:34 PM
Archived
Rev: 1559
Mar 25, 2026, 8:34 PM
Archived
Rev: 1558
Mar 24, 2026, 9:34 PM
Archived
Rev: 1557
Mar 23, 2026, 9:34 PM
Archived
Rev: 1554
Mar 20, 2026, 9:34 PM
Archived
Rev: 1553
Mar 19, 2026, 9:34 PM
Archived
Rev: 1552
Mar 18, 2026, 8:34 PM
Archived
Rev: 1551
Mar 17, 2026, 9:34 PM
Archived
Rev: 1550
Mar 16, 2026, 9:34 PM
Archived
Rev: 1548
Mar 15, 2026, 2:34 AM
Archived
Rev: 1547
Mar 13, 2026, 8:34 PM
Archived
Rev: 1546
Mar 12, 2026, 8:34 PM
Archived
Rev: 1545
Mar 11, 2026, 9:34 PM
Archived
Rev: 1544
Mar 10, 2026, 8:34 PM
Archived
Rev: 1543
Mar 9, 2026, 8:34 PM
Archived
Rev: 1540
Mar 6, 2026, 10:34 PM
Archived
Rev: 1539
Mar 5, 2026, 11:34 PM
Archived
Rev: 1538
Mar 4, 2026, 9:34 PM
Archived
Rev: 1537
Mar 3, 2026, 10:34 PM
Archived
Rev: 1536
Mar 2, 2026, 10:34 PM
Archived
Rev: 1533
Feb 27, 2026, 9:34 PM
Archived
Rev: 1532
Feb 26, 2026, 9:34 PM
Archived
Rev: 1531
Feb 25, 2026, 10:34 PM
Archived
Rev: 1530
Feb 24, 2026, 4:34 PM
Archived
Rev: 1529
Feb 23, 2026, 10:34 PM
Archived
Rev: 1526
Feb 20, 2026, 10:34 PM
Archived
Rev: 1525
Feb 19, 2026, 10:34 PM
Archived
Rev: 1524
Feb 18, 2026, 10:34 PM
Archived
Rev: 1523
Feb 17, 2026, 10:34 PM
Archived
Rev: 1522
Feb 16, 2026, 10:35 PM
Archived
Rev: 1519
Feb 13, 2026, 10:34 PM
Archived
Rev: 1518
Feb 12, 2026, 10:34 PM
Archived
Rev: 1517
Feb 11, 2026, 10:34 PM
Archived
Rev: 1516
Feb 10, 2026, 11:34 PM
Archived
Rev: 1515
Feb 9, 2026, 10:34 PM
Archived
Rev: 1512
Feb 6, 2026, 10:34 PM
Archived
Rev: 1511
Feb 5, 2026, 11:34 PM
Archived
Rev: 1510
Feb 4, 2026, 10:34 PM
Archived
Rev: 1509
Feb 3, 2026, 10:34 PM
Archived
Rev: 1508
Feb 2, 2026, 9:34 PM
Archived
Rev: 1505
Jan 30, 2026, 9:34 PM
Archived
Rev: 1504
Jan 29, 2026, 10:34 PM
Archived
Rev: 1503
Jan 28, 2026, 10:34 PM
Archived
Rev: 1502
Jan 27, 2026, 10:34 PM
Archived
Rev: 1501
Jan 26, 2026, 10:34 PM
Archived
Rev: 1498
Jan 23, 2026, 10:34 PM
Archived
Rev: 1497
Jan 22, 2026, 11:34 PM
Archived
Rev: 1496
Jan 21, 2026, 9:34 PM
Archived
Rev: 1495
Jan 20, 2026, 9:34 PM
Archived
Rev: 1494
Jan 19, 2026, 10:35 PM
Archived
Rev: 1491
Jan 16, 2026, 10:34 PM
Archived
Rev: 1490
Jan 15, 2026, 10:34 PM
Archived
Rev: 1489
Jan 14, 2026, 11:34 PM
Archived
Rev: 1488
Jan 13, 2026, 10:34 PM
Archived
Rev: 1487
Jan 12, 2026, 10:34 PM
Archived
Rev: 1484
Jan 9, 2026, 10:34 PM
Archived
Rev: 1483
Jan 8, 2026, 10:34 PM
Archived
Rev: 1482
Jan 7, 2026, 10:34 PM
Archived
Rev: 1481
Jan 6, 2026, 10:34 PM
Archived
Rev: 1480
Jan 5, 2026, 10:34 PM
Archived
Rev: 1477
Jan 2, 2026, 10:34 PM
Archived
Rev: 1475
Dec 31, 2025, 6:34 PM
Archived
Rev: 1474
Dec 30, 2025, 9:34 PM
Archived
Rev: 1473
Dec 29, 2025, 9:34 PM
Archived
Rev: 1470
Dec 26, 2025, 6:34 PM
Archived
Rev: 1468
Dec 24, 2025, 5:34 PM
Archived
Rev: 1467
Dec 23, 2025, 9:34 PM
Archived
Rev: 1466
Dec 22, 2025, 10:34 PM
Archived
Rev: 1463
Dec 19, 2025, 10:34 PM
Archived
Rev: 1462
Dec 18, 2025, 10:34 PM
Archived
Rev: 1461
Dec 17, 2025, 11:34 PM
Archived
Rev: 1460
Dec 16, 2025, 10:34 PM
Archived
Rev: 1459
Dec 15, 2025, 10:34 PM
Archived
Rev: 1456
Dec 12, 2025, 10:34 PM
Archived
Rev: 1455
Dec 11, 2025, 10:34 PM
Archived
Rev: 1454
Dec 10, 2025, 11:34 PM
Archived
Rev: 1453
Dec 9, 2025, 10:34 PM
Archived
Rev: 1452
Dec 8, 2025, 10:34 PM
Archived
Rev: 1449
Dec 5, 2025, 11:34 PM
Archived
Rev: 1448
Dec 4, 2025, 10:34 PM
Archived
Rev: 1447
Dec 3, 2025, 10:34 PM
Archived
Rev: 1446
Dec 2, 2025, 11:34 PM
Archived
Rev: 1445
Dec 1, 2025, 11:34 PM
Archived
Rev: 1441
Nov 27, 2025, 9:34 PM
Archived
Rev: 1440
Nov 26, 2025, 10:34 PM
Archived
Rev: 1439
Nov 25, 2025, 9:34 PM
Archived
Rev: 1438
Nov 24, 2025, 10:34 PM
Archived
Rev: 1435
Nov 21, 2025, 9:34 PM
Archived
Rev: 1434
Nov 20, 2025, 10:34 PM
Archived
Rev: 1433
Nov 20, 2025, 12:34 AM
Archived
Rev: 1432
Nov 18, 2025, 10:34 PM
Archived
Rev: 1431
Nov 17, 2025, 10:34 PM
Archived
Rev: 1428
Nov 13, 2025, 9:34 PM
Archived
Rev: 1427
Nov 12, 2025, 10:34 PM
Archived
Rev: 1426
Nov 11, 2025, 10:34 PM
Archived
Rev: 1425
Nov 10, 2025, 10:34 PM
Archived
Rev: 1422
Nov 7, 2025, 9:34 PM
Archived
Rev: 1421
Nov 6, 2025, 10:34 PM
Archived
Rev: 1420
Nov 5, 2025, 10:34 PM
Archived
Rev: 1419
Nov 4, 2025, 10:34 PM
Archived
Rev: 1418
Nov 3, 2025, 10:34 PM
Archived

Version Details

Rev: 1433 • Dec 9, 2021, 12:00 PM

ET Threatview.io High Confidence Cobalt Strike C2 IP group 20

alert ip [167.99.80.207,144.217.207.19,139.155.190.84,82.156.241.148,81.70.229.78,82.156.2.25,52.175.122.61,47.102.117.86,23.224.70.227,39.99.173.55,139.198.174.135,139.198.181.156,132.232.40.201,139.198.108.26,111.230.198.142,106.54.69.144,1.117.154.185,111.229.51.128,139.155.190.117,168.61.180.98,23.224.152.138,23.224.152.138,104.243.41.123,106.55.153.204,165.227.85.160,167.99.197.196] any -> $HOME_NET any (msg:"ET Threatview.io High Confidence Cobalt Strike C2 IP group 20"; reference:url,threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2527019; rev:1433; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Threatview_CS, signature_severity Major, created_at 2021_12_09, updated_at 2025_11_19;)

Dec 9, 2021, 12:00 PM

Nov 19, 2025, 12:00 PM

Nov 3, 2025, 10:34 PM

Nov 20, 2025, 12:34 AM

Nov 20, 2025, 10:34 PM

rules/threatview_CS_c2.rules