Back to Rule

Rule History

SID: 2527019 • Source: et/open

Versions (145)

Rev: 1621
May 29, 2026, 8:35 PM
Current
Rev: 1620
May 28, 2026, 9:09 PM
Archived
Rev: 1619
May 27, 2026, 9:21 PM
Archived
Rev: 1618
May 26, 2026, 8:12 PM
Archived
Rev: 1614
May 22, 2026, 8:34 PM
Archived
Rev: 1613
May 21, 2026, 9:34 PM
Archived
Rev: 1612
May 20, 2026, 8:35 PM
Archived
Rev: 1611
May 19, 2026, 8:34 PM
Archived
Rev: 1610
May 18, 2026, 9:34 PM
Archived
Rev: 1607
May 15, 2026, 8:34 PM
Archived
Rev: 1606
May 14, 2026, 10:34 PM
Archived
Rev: 1605
May 13, 2026, 9:35 PM
Archived
Rev: 1604
May 12, 2026, 9:34 PM
Archived
Rev: 1603
May 11, 2026, 9:35 PM
Archived
Rev: 1600
May 8, 2026, 9:35 PM
Archived
Rev: 1599
May 7, 2026, 8:34 PM
Archived
Rev: 1598
May 6, 2026, 9:34 PM
Archived
Rev: 1597
May 5, 2026, 9:34 PM
Archived
Rev: 1596
May 4, 2026, 8:35 PM
Archived
Rev: 1593
May 1, 2026, 8:34 PM
Archived
Rev: 1592
Apr 30, 2026, 9:34 PM
Archived
Rev: 1591
Apr 29, 2026, 9:34 PM
Archived
Rev: 1590
Apr 28, 2026, 8:35 PM
Archived
Rev: 1589
Apr 27, 2026, 10:34 PM
Archived
Rev: 1586
Apr 24, 2026, 8:35 PM
Archived
Rev: 1585
Apr 23, 2026, 9:34 PM
Archived
Rev: 1584
Apr 22, 2026, 9:34 PM
Archived
Rev: 1583
Apr 21, 2026, 9:34 PM
Archived
Rev: 1582
Apr 20, 2026, 9:34 PM
Archived
Rev: 1579
Apr 17, 2026, 9:34 PM
Archived
Rev: 1578
Apr 16, 2026, 9:34 PM
Archived
Rev: 1577
Apr 15, 2026, 9:34 PM
Archived
Rev: 1576
Apr 14, 2026, 9:34 PM
Archived
Rev: 1575
Apr 13, 2026, 9:34 PM
Archived
Rev: 1572
Apr 10, 2026, 6:35 PM
Archived
Rev: 1571
Apr 9, 2026, 9:35 PM
Archived
Rev: 1570
Apr 8, 2026, 9:34 PM
Archived
Rev: 1569
Apr 7, 2026, 8:34 PM
Archived
Rev: 1568
Apr 6, 2026, 9:34 PM
Archived
Rev: 1567
Apr 2, 2026, 9:34 PM
Archived
Rev: 1566
Apr 1, 2026, 9:34 PM
Archived
Rev: 1565
Mar 31, 2026, 9:35 PM
Archived
Rev: 1564
Mar 30, 2026, 9:34 PM
Archived
Rev: 1561
Mar 27, 2026, 8:34 PM
Archived
Rev: 1560
Mar 26, 2026, 8:34 PM
Archived
Rev: 1559
Mar 25, 2026, 8:34 PM
Archived
Rev: 1558
Mar 24, 2026, 9:34 PM
Archived
Rev: 1557
Mar 23, 2026, 9:34 PM
Archived
Rev: 1554
Mar 20, 2026, 9:34 PM
Archived
Rev: 1553
Mar 19, 2026, 9:34 PM
Archived
Rev: 1552
Mar 18, 2026, 8:34 PM
Archived
Rev: 1551
Mar 17, 2026, 9:34 PM
Archived
Rev: 1550
Mar 16, 2026, 9:34 PM
Archived
Rev: 1548
Mar 15, 2026, 2:34 AM
Archived
Rev: 1547
Mar 13, 2026, 8:34 PM
Archived
Rev: 1546
Mar 12, 2026, 8:34 PM
Archived
Rev: 1545
Mar 11, 2026, 9:34 PM
Archived
Rev: 1544
Mar 10, 2026, 8:34 PM
Archived
Rev: 1543
Mar 9, 2026, 8:34 PM
Archived
Rev: 1540
Mar 6, 2026, 10:34 PM
Archived
Rev: 1539
Mar 5, 2026, 11:34 PM
Archived
Rev: 1538
Mar 4, 2026, 9:34 PM
Archived
Rev: 1537
Mar 3, 2026, 10:34 PM
Archived
Rev: 1536
Mar 2, 2026, 10:34 PM
Archived
Rev: 1533
Feb 27, 2026, 9:34 PM
Archived
Rev: 1532
Feb 26, 2026, 9:34 PM
Archived
Rev: 1531
Feb 25, 2026, 10:34 PM
Archived
Rev: 1530
Feb 24, 2026, 4:34 PM
Archived
Rev: 1529
Feb 23, 2026, 10:34 PM
Archived
Rev: 1526
Feb 20, 2026, 10:34 PM
Archived
Rev: 1525
Feb 19, 2026, 10:34 PM
Archived
Rev: 1524
Feb 18, 2026, 10:34 PM
Archived
Rev: 1523
Feb 17, 2026, 10:34 PM
Archived
Rev: 1522
Feb 16, 2026, 10:35 PM
Archived
Rev: 1519
Feb 13, 2026, 10:34 PM
Archived
Rev: 1518
Feb 12, 2026, 10:34 PM
Archived
Rev: 1517
Feb 11, 2026, 10:34 PM
Archived
Rev: 1516
Feb 10, 2026, 11:34 PM
Archived
Rev: 1515
Feb 9, 2026, 10:34 PM
Archived
Rev: 1512
Feb 6, 2026, 10:34 PM
Archived
Rev: 1511
Feb 5, 2026, 11:34 PM
Archived
Rev: 1510
Feb 4, 2026, 10:34 PM
Archived
Rev: 1509
Feb 3, 2026, 10:34 PM
Archived
Rev: 1508
Feb 2, 2026, 9:34 PM
Archived
Rev: 1505
Jan 30, 2026, 9:34 PM
Archived
Rev: 1504
Jan 29, 2026, 10:34 PM
Archived
Rev: 1503
Jan 28, 2026, 10:34 PM
Archived
Rev: 1502
Jan 27, 2026, 10:34 PM
Archived
Rev: 1501
Jan 26, 2026, 10:34 PM
Archived
Rev: 1498
Jan 23, 2026, 10:34 PM
Archived
Rev: 1497
Jan 22, 2026, 11:34 PM
Archived
Rev: 1496
Jan 21, 2026, 9:34 PM
Archived
Rev: 1495
Jan 20, 2026, 9:34 PM
Archived
Rev: 1494
Jan 19, 2026, 10:35 PM
Archived
Rev: 1491
Jan 16, 2026, 10:34 PM
Archived
Rev: 1490
Jan 15, 2026, 10:34 PM
Archived
Rev: 1489
Jan 14, 2026, 11:34 PM
Archived
Rev: 1488
Jan 13, 2026, 10:34 PM
Archived
Rev: 1487
Jan 12, 2026, 10:34 PM
Archived
Rev: 1484
Jan 9, 2026, 10:34 PM
Archived
Rev: 1483
Jan 8, 2026, 10:34 PM
Archived
Rev: 1482
Jan 7, 2026, 10:34 PM
Archived
Rev: 1481
Jan 6, 2026, 10:34 PM
Archived
Rev: 1480
Jan 5, 2026, 10:34 PM
Archived
Rev: 1477
Jan 2, 2026, 10:34 PM
Archived
Rev: 1475
Dec 31, 2025, 6:34 PM
Archived
Rev: 1474
Dec 30, 2025, 9:34 PM
Archived
Rev: 1473
Dec 29, 2025, 9:34 PM
Archived
Rev: 1470
Dec 26, 2025, 6:34 PM
Archived
Rev: 1468
Dec 24, 2025, 5:34 PM
Archived
Rev: 1467
Dec 23, 2025, 9:34 PM
Archived
Rev: 1466
Dec 22, 2025, 10:34 PM
Archived
Rev: 1463
Dec 19, 2025, 10:34 PM
Archived
Rev: 1462
Dec 18, 2025, 10:34 PM
Archived
Rev: 1461
Dec 17, 2025, 11:34 PM
Archived
Rev: 1460
Dec 16, 2025, 10:34 PM
Archived
Rev: 1459
Dec 15, 2025, 10:34 PM
Archived
Rev: 1456
Dec 12, 2025, 10:34 PM
Archived
Rev: 1455
Dec 11, 2025, 10:34 PM
Archived
Rev: 1454
Dec 10, 2025, 11:34 PM
Archived
Rev: 1453
Dec 9, 2025, 10:34 PM
Archived
Rev: 1452
Dec 8, 2025, 10:34 PM
Archived
Rev: 1449
Dec 5, 2025, 11:34 PM
Archived
Rev: 1448
Dec 4, 2025, 10:34 PM
Archived
Rev: 1447
Dec 3, 2025, 10:34 PM
Archived
Rev: 1446
Dec 2, 2025, 11:34 PM
Archived
Rev: 1445
Dec 1, 2025, 11:34 PM
Archived
Rev: 1441
Nov 27, 2025, 9:34 PM
Archived
Rev: 1440
Nov 26, 2025, 10:34 PM
Archived
Rev: 1439
Nov 25, 2025, 9:34 PM
Archived
Rev: 1438
Nov 24, 2025, 10:34 PM
Archived
Rev: 1435
Nov 21, 2025, 9:34 PM
Archived
Rev: 1434
Nov 20, 2025, 10:34 PM
Archived
Rev: 1433
Nov 20, 2025, 12:34 AM
Archived
Rev: 1432
Nov 18, 2025, 10:34 PM
Archived
Rev: 1431
Nov 17, 2025, 10:34 PM
Archived
Rev: 1428
Nov 13, 2025, 9:34 PM
Archived
Rev: 1427
Nov 12, 2025, 10:34 PM
Archived
Rev: 1426
Nov 11, 2025, 10:34 PM
Archived
Rev: 1425
Nov 10, 2025, 10:34 PM
Archived
Rev: 1422
Nov 7, 2025, 9:34 PM
Archived
Rev: 1421
Nov 6, 2025, 10:34 PM
Archived
Rev: 1420
Nov 5, 2025, 10:34 PM
Archived
Rev: 1419
Nov 4, 2025, 10:34 PM
Archived
Rev: 1418
Nov 3, 2025, 10:34 PM
Archived

Version Details

Rev: 1599 • Dec 9, 2021, 12:00 PM

ET Threatview.io High Confidence Cobalt Strike C2 IP group 20

alert ip [139.60.161.45,139.60.161.57,172.104.232.196,164.90.153.100,3.13.144.126,143.198.190.57,45.142.122.59,78.128.112.199,143.198.150.148,5.39.222.151,185.150.117.189,139.60.161.69,31.7.62.24,139.60.161.47,3.20.104.56,18.217.66.68,167.99.80.207,3.20.104.56,80.249.144.233,147.182.220.15,149.56.127.166,216.244.71.155,84.38.182.248,80.249.144.233,80.249.145.212,77.223.99.210,216.244.71.155,5.101.50.140,164.90.154.97,149.56.127.166,147.182.220.15,167.172.136.160,146.0.77.18,5.39.223.131,66.42.33.159,54.196.7.25,143.198.150.148,23.227.198.246,3.13.144.126,194.37.97.153,217.79.243.148,149.255.35.131,193.201.9.229,185.150.119.157,185.70.184.2,172.96.189.218,23.224.152.138,185.244.150.102,172.96.189.218,23.227.198.246] any -> $HOME_NET any (msg:"ET Threatview.io High Confidence Cobalt Strike C2 IP group 20"; reference:url,threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt; threshold:type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2527019; rev:1599; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag Threatview_CS, signature_severity Major, created_at 2021_12_09, updated_at 2026_05_07;)

Dec 9, 2021, 12:00 PM

May 7, 2026, 12:00 PM

Nov 3, 2025, 10:34 PM

May 7, 2026, 8:34 PM

May 8, 2026, 9:35 PM

rules/threatview_CS_c2.rules