Live Chat Software by Kayako |
Notícias
|
Aug 18 |
ProApps Security IDS Rules Changelog 2016-08-17
Postado por Rafael Honorato on 18/Aug 09:13
|
[***] Summary 2016-08-17 [***] Total added rules: 202 Total modified rules: 625 Total removed rules: 46 [***] ProApps Security IDS Rules Changelog started Tue Aug 16 17:49:54 2016 [***] [+++] Added rules: 20 [+++] 2023067 - ProApps INFO Symantec Download Flowbit Set (info.rules) 2023068 - ProApps CURRENT_EVENTS Suspicious HTTP Refresh to SMS Aug 16 2016 (current_events.rules) 2023069 - ProApps CURRENT_EVENTS SMS Fake Mobile Virus Scam Aug 16 2016 (current_events.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2821691 - ProApps TROJAN Unknown Smokebot 2nd Stage Payload M1 (trojan.rules) 2821692 - ProApps TROJAN Unknown Smokebot 2nd Stage Payload M2 (trojan.rules) 2821693 - ProApps TROJAN W32/Ramnit Initial CnC Connection (trojan.rules) 2821694 - ProApps TROJAN Bladabindi/njRAT Variant CnC Checkin (trojan.rules) 2821695 - ProApps TROJAN MSIL/Bancos Variant CnC Activity (trojan.rules) 2821696 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l Checkin 2 (mobile_malware.rules) 2821697 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l SMS Exfil (mobile_malware.rules) 2821698 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l DNS Lookup 7 (mobile_malware.rules) 2821699 - ProApps TROJAN PoisonIvy Keepalive to CnC 474 (trojan.rules) 2821700 - ProApps TROJAN LuminosityLink - Data Channel Server Response 3 (trojan.rules) 2821701 - ProApps TROJAN Unknown Likely APT CnC Beacon (trojan.rules) 2821702 - ProApps CURRENT_EVENTS Successful Phish OWA Credentials Aug 16 2016 (current_events.rules) 2821703 - ProApps CURRENT_EVENTS Adobe Phishing Landing M1 Aug 16 2016 (current_events.rules) 2821704 - ProApps CURRENT_EVENTS Successful Adobe Online Phish Aug 16 2016 (current_events.rules) 2821705 - ProApps CURRENT_EVENTS Adobe Phishing Landing M2 Aug 16 2016 (current_events.rules) [+++] Modify rules: 88 [+++] 2008438 - ProApps MALWARE Possible Windows executable sent when remote host claims to send a Text File (malware.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 2009 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 3211 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 6677 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2820198 - ProApps TROJAN APT.SVCMONDR CnC Checkin (trojan.rules) 2821169 - ProApps TROJAN Patchwork APT File Exfil HTTP POST (trojan.rules) [+++] Removed rules: 2 [+++] 2022916 - ProApps CURRENT_EVENTS RIG EK Payload Jun 26 2016 (current_events.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) [***] ProApps Security IDS Rules Changelog started Mon Aug 15 18:51:05 2016 [***] [+++] Added rules: 60 [+++] 2023059 - ProApps TROJAN DarkHotel DNS Lookup (apply-wsu.ebizx.net) (trojan.rules) 2023060 - ProApps TROJAN DarkHotel DNS Lookup (apply.ebizx.net) (trojan.rules) 2023061 - ProApps CURRENT_EVENTS Successful Excel Phish Aug 15 2016 (current_events.rules) 2023062 - ProApps CURRENT_EVENTS Email Storage Upgrade Phishing Landing Aug 15 2016 (current_events.rules) 2023063 - ProApps CURRENT_EVENTS Successful Credit Agricole Phish Aug 15 2016 M1 (current_events.rules) 2023064 - ProApps CURRENT_EVENTS Successful Credit Agricole Phish Aug 15 2016 M2 (current_events.rules) 2023065 - ProApps CURRENT_EVENTS Possible Square Enix Phishing Domain Aug 15 2016 (current_events.rules) 2023066 - ProApps CURRENT_EVENTS Possible Bank of America Phishing Domain Aug 15 2016 (current_events.rules) 2821639 - ProApps TROJAN PoisonIvy Keepalive to CnC 472 (trojan.rules) 2821640 - ProApps TROJAN PoisonIvy Keepalive to CnC 473 (trojan.rules) 2821641 - ProApps TROJAN Win32.Shakti HTTP Pattern (trojan.rules) 2821642 - ProApps TROJAN Win32.Shakti Checkin (trojan.rules) 2821643 - ProApps TROJAN Win32.Shakti Sending Process List (trojan.rules) 2821644 - ProApps TROJAN Win32.Shakti Uploading Files (trojan.rules) 2821645 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr (set) Aug 15 2016 (current_events.rules) 2821646 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M1 (current_events.rules) 2821647 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M2 (current_events.rules) 2821648 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M3 (current_events.rules) 2821649 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M4 (current_events.rules) 2821650 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M5 (current_events.rules) 2821651 - ProApps CURRENT_EVENTS Phishing Landing via webnode.fr Aug 15 2016 M6 (current_events.rules) 2821652 - ProApps INFO Webform Submitted via webnode.fr - Possible Successful Phish Aug 15 2016 (info.rules) 2821653 - ProApps TROJAN TampStealer/Keylogger Requesting Executable (trojan.rules) 2821654 - ProApps TROJAN CoinMiner Known Malicious Stratum Authline (2016-08-15 1) (trojan.rules) 2821655 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 1 (GET) (trojan.rules) 2821656 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 2 (GET) (trojan.rules) 2821657 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 3 (GET) (trojan.rules) 2821658 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 4 (GET) (trojan.rules) 2821659 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 5 (GET) (trojan.rules) 2821660 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 6 (GET) (trojan.rules) 2821661 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 7 (GET) (trojan.rules) 2821662 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 8 (GET) (trojan.rules) 2821663 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 9 (GET) (trojan.rules) 2821664 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 10 (GET) (trojan.rules) 2821665 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 11 (GET) (trojan.rules) 2821666 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 12 (GET) (trojan.rules) 2821667 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 13 (GET) (trojan.rules) 2821668 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 14 (GET) (trojan.rules) 2821669 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 1 (POST) (trojan.rules) 2821670 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 2 (POST) (trojan.rules) 2821671 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 3 (POST) (trojan.rules) 2821672 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 4 (POST) (trojan.rules) 2821673 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 5 (POST) (trojan.rules) 2821674 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 6 (POST) (trojan.rules) 2821675 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 7 (POST) (trojan.rules) 2821676 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 8 (POST) (trojan.rules) 2821677 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 9 (POST) (trojan.rules) 2821678 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 10 (POST) (trojan.rules) 2821679 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 11 (POST) (trojan.rules) 2821680 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 12 (POST) (trojan.rules) 2821681 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 13 (POST) (trojan.rules) 2821682 - ProApps TROJAN JSP WebShell Backdoor.Hadmad Command 14 (POST) (trojan.rules) 2821683 - ProApps SCADA DNP3 Cold Restart (scada.rules) 2821684 - ProApps SCADA DNP3 Warm Restart (scada.rules) 2821685 - ProApps SCADA DNP3 Write Time and Date (scada.rules) 2821686 - ProApps SCADA DNP3 Stop Application (scada.rules) 2821687 - ProApps SCADA DNP3 Enable Unsolicited Messages (scada.rules) 2821688 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l Checkin (mobile_malware.rules) 2821689 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l DNS Lookup 5 (mobile_malware.rules) 2821690 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Marcher.l DNS Lookup 6 (mobile_malware.rules) [+++] Modify rules: 122 [+++] 2400000 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 1 (drop.rules) 2400001 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 2 (drop.rules) 2400002 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 3 (drop.rules) 2400003 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 4 (drop.rules) 2400004 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 5 (drop.rules) 2400005 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 6 (drop.rules) 2400006 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 7 (drop.rules) 2400007 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 8 (drop.rules) 2400008 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 9 (drop.rules) 2400009 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 10 (drop.rules) 2400010 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 11 (drop.rules) 2400011 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 12 (drop.rules) 2400012 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 13 (drop.rules) 2400013 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 14 (drop.rules) 2400014 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 15 (drop.rules) 2400015 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 16 (drop.rules) 2400016 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 17 (drop.rules) 2400017 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 18 (drop.rules) 2400018 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 19 (drop.rules) 2400019 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 20 (drop.rules) 2400020 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 21 (drop.rules) 2400021 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 22 (drop.rules) 2400022 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 23 (drop.rules) 2400023 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 24 (drop.rules) 2400024 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 25 (drop.rules) 2400025 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 26 (drop.rules) 2400026 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 27 (drop.rules) 2400027 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 28 (drop.rules) 2400028 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 29 (drop.rules) 2400029 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 30 (drop.rules) 2400030 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 31 (drop.rules) 2400031 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 32 (drop.rules) 2400032 - ProApps DROP Spamhaus DROP Listed Traffic Inbound group 33 (drop.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 3211 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2820902 - ProApps TROJAN Cookle CnC Checkin (trojan.rules) 2820903 - ProApps TROJAN Cookle CnC POST (trojan.rules) 2821196 - ProApps WEB_SERVER Likely Malicious Proxy Header in Inbound HTTP Request (web_server.rules) [+++] Removed rules: 11 [+++] 2403338 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 39 (ciarmy.rules) 2403339 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 40 (ciarmy.rules) 2403340 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 41 (ciarmy.rules) 2403341 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 42 (ciarmy.rules) 2403342 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 43 (ciarmy.rules) 2403343 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 44 (ciarmy.rules) 2403344 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 45 (ciarmy.rules) 2403345 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 46 (ciarmy.rules) 2403346 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 47 (ciarmy.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) [***] ProApps Security IDS Rules Changelog started Fri Aug 12 18:22:43 2016 [***] [+++] Added rules: 26 [+++] 2023051 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 12 M1 (current_events.rules) 2023052 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 12 M2 (current_events.rules) 2023053 - ProApps DOS DNS Amplification Attack Possible Inbound Windows Non-Recursive Root Hint Reserved Port (dos.rules) 2023054 - ProApps DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port (dos.rules) 2023055 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing (err.mp3) Aug 12 2016 (current_events.rules) 2023056 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing (msg.mp3) Aug 12 2016 (current_events.rules) 2023057 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing M1 Aug 12 2016 (current_events.rules) 2023058 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing M2 Aug 12 2016 (current_events.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2821622 - ProApps TROJAN Python/SupAgent .onion Proxy Domain (trojan.rules) 2821623 - ProApps TROJAN APT.Enfal SSL Cert - Downloaded by Cmstar (trojan.rules) 2821624 - ProApps TROJAN Observed Malicious SSL Cert (Zeus Panda Injects) (trojan.rules) 2821625 - ProApps TROJAN Observed Malicious SSL Cert (Zeus Panda Injects) (trojan.rules) 2821626 - ProApps TROJAN MSIL/Bancos Variant CnC Checkin (trojan.rules) 2821627 - ProApps WEB_SPECIFIC_APPS Drupal Module Coder RCE PoC Inbound (web_specific_apps.rules) 2821628 - ProApps WEB_SPECIFIC_APPS wSecure WP Plugin RCE (web_specific_apps.rules) 2821629 - ProApps CURRENT_EVENTS Stripe Phishing Landing Aug 12 2016 (current_events.rules) 2821630 - ProApps CURRENT_EVENTS Successful Stripe Phish Aug 12 2016 (current_events.rules) 2821631 - ProApps CURRENT_EVENTS Successful Adobe/Excel Phish Aug 12 2016 (current_events.rules) 2821632 - ProApps CURRENT_EVENTS Successful Gmail Phish M1 Aug 12 2016 (current_events.rules) 2821633 - ProApps CURRENT_EVENTS Successful Gmail Phish M2 (set) Aug 12 2016 (current_events.rules) 2821634 - ProApps CURRENT_EVENTS Successful Gmail Phish M2 Aug 12 2016 (current_events.rules) 2821635 - ProApps TROJAN Python/Charm CnC Beacon (trojan.rules) 2821636 - ProApps WEB_SERVER JexBoss User-Agent Observed (INBOUND) (web_server.rules) 2821637 - ProApps WEB_SERVER JexBoss Common URI struct Observed (INBOUND) (web_server.rules) 2821638 - ProApps WEB_SERVER JexBoss Common URI struct Observed 2 (INBOUND) (web_server.rules) [+++] Modify rules: 97 [+++] 2013352 - ProApps TROJAN Executable Download Purporting to be JavaScript likely 2nd stage Infection (trojan.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) 2403338 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 39 (ciarmy.rules) 2403339 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 40 (ciarmy.rules) 2403340 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 41 (ciarmy.rules) 2403341 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 42 (ciarmy.rules) 2403342 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 43 (ciarmy.rules) 2403343 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 44 (ciarmy.rules) 2403344 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 45 (ciarmy.rules) 2403345 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 46 (ciarmy.rules) 2403346 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 47 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 1863 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6678 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 6900 Group 1 (botcc.portgrouped.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) [+++] Removed rules: 5 [+++] 2403347 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 48 (ciarmy.rules) 2403348 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 49 (ciarmy.rules) 2403349 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 50 (ciarmy.rules) 2403350 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 51 (ciarmy.rules) 2403351 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 52 (ciarmy.rules) [***] ProApps Security IDS Rules Changelog started Thu Aug 11 17:32:16 2016 [***] [+++] Added rules: 26 [+++] 2023047 - ProApps CURRENT_EVENTS Adobe Shared Document Phishing Landing Nov 19 2015 (current_events.rules) 2023048 - ProApps CURRENT_EVENTS Successful Generic Adobe Shared Document Phish Aug 11 2016 (current_events.rules) 2023049 - ProApps TROJAN Monsoon Tinytyphon CnC Beacon GET (trojan.rules) 2023050 - ProApps TROJAN Monsoon Tinytyphon CnC Beacon Exfiltrating Docs (trojan.rules) 2821600 - ProApps TROJAN MSIL/Unknown Backdoor CnC Checkin (trojan.rules) 2821601 - ProApps TROJAN Lance Stealer Screenshot Exfil (trojan.rules) 2821602 - ProApps TROJAN Malicious SSL certificate detected (Malware C2) (trojan.rules) 2821603 - ProApps TROJAN Win32.Getapula Stealer Checkin (trojan.rules) 2821604 - ProApps MOBILE_MALWARE Android.Trojan.FakeBank.BA APK Download (mobile_malware.rules) 2821605 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821606 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821607 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821608 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821609 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821610 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821611 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821612 - ProApps TROJAN APT28 XAgent SSL Cert (trojan.rules) 2821613 - ProApps TROJAN Observed Malicious SSL Cert (Zeus Panda Banker) (trojan.rules) 2821614 - ProApps TROJAN PoisonIvy Keepalive to CnC 471 (trojan.rules) 2821615 - ProApps CURRENT_EVENTS Possible MalDoc Download Request (set) (current_events.rules) 2821616 - ProApps CURRENT_EVENTS MalDoc Payload Inbound Aug 11 (current_events.rules) 2821617 - ProApps CURRENT_EVENTS Successful DHL Phish Aug 11 2016 (current_events.rules) 2821618 - ProApps CURRENT_EVENTS Successful Adobe Shared Document Phish Aug 11 2016 (current_events.rules) 2821619 - ProApps CURRENT_EVENTS Successful USAA Phish Aug 11 2016 (current_events.rules) 2821620 - ProApps TROJAN OwaAuth/Soybalek Backdoor Magic String (INBOUND) 1 (trojan.rules) 2821621 - ProApps TROJAN OwaAuth/Soybalek Backdoor Magic String (INBOUND) 2 (trojan.rules) [+++] Modify rules: 102 [+++] 2006406 - ProApps TROJAN Proxy.Win32.Agent.mx (2) (trojan.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) 2403338 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 39 (ciarmy.rules) 2403339 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 40 (ciarmy.rules) 2403340 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 41 (ciarmy.rules) 2403341 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 42 (ciarmy.rules) 2403342 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 43 (ciarmy.rules) 2403343 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 44 (ciarmy.rules) 2403344 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 45 (ciarmy.rules) 2403345 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 46 (ciarmy.rules) 2403346 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 47 (ciarmy.rules) 2403347 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 48 (ciarmy.rules) 2403348 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 49 (ciarmy.rules) 2403349 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 50 (ciarmy.rules) 2403350 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 51 (ciarmy.rules) 2403351 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 52 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 1993 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 6900 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) [+++] Removed rules: 6 [+++] 2403352 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 53 (ciarmy.rules) 2403353 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 54 (ciarmy.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405049 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405050 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2815029 - ProApps CURRENT_EVENTS Adobe Shared Document Phishing Landing Nov 19 (current_events.rules) [***] ProApps Security IDS Rules Changelog started Wed Aug 10 17:14:07 2016 [***] [+++] Added rules: 25 [+++] 2023034 - ProApps TROJAN Linux/Lady CnC Beacon 1 (trojan.rules) 2023035 - ProApps TROJAN Linux/Lady CnC Beacon 2 (trojan.rules) 2023036 - ProApps CURRENT_EVENTS EITest Flash Redirect Aug 09 2016 (current_events.rules) 2023037 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 10 M1 (current_events.rules) 2023038 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 10 M2 (current_events.rules) 2023039 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 10 M3 (current_events.rules) 2023040 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 10 M4 (current_events.rules) 2023041 - ProApps CURRENT_EVENTS Tech Support Phone Scam Landing Aug 10 M5 (current_events.rules) 2023042 - ProApps CURRENT_EVENTS Successful Apple Suspended Account Phish Aug 9 M1 (current_events.rules) 2023043 - ProApps CURRENT_EVENTS Successful Apple Suspended Account Phish Aug 9 M2 (current_events.rules) 2023044 - ProApps CURRENT_EVENTS Apple Suspended Account Phishing Landing Aug 9 (current_events.rules) 2023045 - ProApps CURRENT_EVENTS Excel Online Phishing Landing Aug 9 (current_events.rules) 2023046 - ProApps CURRENT_EVENTS Successful Generic Excel Online Phish Aug 9 (current_events.rules) 2405050 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2821589 - ProApps MOBILE_MALWARE Trojan-Banker.AndroidOS.Gepew.a Checkin (mobile_malware.rules) 2821590 - ProApps TROJAN Win32.Pony Variant Checkin (trojan.rules) 2821591 - ProApps TROJAN Win32.Spy/TVRat/Shade Ransomware Checkin 2 (trojan.rules) 2821592 - ProApps CURRENT_EVENTS DHL/EMS Documents Phishing Landing Aug 10 2016 (current_events.rules) 2821593 - ProApps CURRENT_EVENTS Suspicious Credential POST to FormBuddy.com - Possible Phishing Aug 10 2016 (current_events.rules) 2821594 - ProApps CURRENT_EVENTS Successful TD Commercial Banking Phish Aug 10 2016 (current_events.rules) 2821595 - ProApps CURRENT_EVENTS Possible Phishing Landing - Tectite Web Form Abuse (current_events.rules) 2821596 - ProApps CURRENT_EVENTS Tectite Web Form Submission - Possible Successful Phish (current_events.rules) 2821597 - ProApps INFO Successful Tectite Web Form Submission - Possible Phishing (info.rules) 2821598 - ProApps CURRENT_EVENTS Successful Adobe Shared Document Phish Aug 10 2016 (current_events.rules) 2821599 - ProApps CURRENT_EVENTS Adobe Shared Document Phishing Landing Common CSS Aug 10 2016 (current_events.rules) [+++] Modify rules: 110 [+++] 2021747 - ProApps TROJAN Win32.Spy/TVRat/Shade Ransomware Checkin (trojan.rules) 2022983 - ProApps CURRENT_EVENTS Possible Maldoc Downloading EXE Jul 26 2016 (current_events.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) 2403338 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 39 (ciarmy.rules) 2403339 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 40 (ciarmy.rules) 2403340 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 41 (ciarmy.rules) 2403341 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 42 (ciarmy.rules) 2403342 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 43 (ciarmy.rules) 2403343 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 44 (ciarmy.rules) 2403344 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 45 (ciarmy.rules) 2403345 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 46 (ciarmy.rules) 2403346 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 47 (ciarmy.rules) 2403347 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 48 (ciarmy.rules) 2403348 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 49 (ciarmy.rules) 2403349 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 50 (ciarmy.rules) 2403350 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 51 (ciarmy.rules) 2403351 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 52 (ciarmy.rules) 2403352 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 53 (ciarmy.rules) 2403353 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 54 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 1661 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 2009 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3211 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 6677 Group 1 (botcc.portgrouped.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 6900 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405049 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2811176 - ProApps TROJAN Luminosity Link RAT CnC Beacon Outbound (trojan.rules) 2814261 - ProApps TROJAN Ursnif Fetching DGA Seed (trojan.rules) 2814364 - ProApps TROJAN Possible IIS Backdoor Receiving Commands via URI (trojan.rules) [+++] Removed rules: 9 [+++] 2403354 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 55 (ciarmy.rules) 2403355 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 56 (ciarmy.rules) 2403356 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 57 (ciarmy.rules) 2403357 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 58 (ciarmy.rules) 2403358 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 59 (ciarmy.rules) 2821078 - ProApps EXPLOIT Win32k Privilege Elevation Vulnerability (CVE-2016-3249) (exploit.rules) 2821079 - ProApps EXPLOIT Win32k Privilege Elevation Vulnerability (CVE-2016-3250) (exploit.rules) 2821080 - ProApps EXPLOIT Win32kfull OOB Read Privilege Elevation Vulnerability (CVE-2016-3251) (exploit.rules) 2821081 - ProApps EXPLOIT Win32k Privilege Elevation Vulnerability (CVE-2016-3252) (exploit.rules) [***] ProApps Security IDS Rules Changelog started Tue Aug 9 18:31:31 2016 [***] [+++] Added rules: 45 [+++] 2023028 - ProApps TROJAN RAMNIT.A M1 (trojan.rules) 2023029 - ProApps TROJAN RAMNIT.A M2 (trojan.rules) 2023030 - ProApps TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2) (trojan.rules) 2023031 - ProApps TROJAN ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2) (trojan.rules) 2023032 - ProApps TROJAN ProjectSauron Remsec CnC Beacon (hardcoded HTTP headers) (trojan.rules) 2023033 - ProApps TROJAN Win32/Radonskra.B C2 Check-in (trojan.rules) 2405037 - ProApps CNC Shadowserver Reported CnC Server Port 7000 Group 1 (botcc.portgrouped.rules) 2405038 - ProApps CNC Shadowserver Reported CnC Server Port 7100 Group 1 (botcc.portgrouped.rules) 2405039 - ProApps CNC Shadowserver Reported CnC Server Port 7770 Group 1 (botcc.portgrouped.rules) 2405040 - ProApps CNC Shadowserver Reported CnC Server Port 8080 Group 1 (botcc.portgrouped.rules) 2405041 - ProApps CNC Shadowserver Reported CnC Server Port 8089 Group 1 (botcc.portgrouped.rules) 2405042 - ProApps CNC Shadowserver Reported CnC Server Port 8585 Group 1 (botcc.portgrouped.rules) 2405043 - ProApps CNC Shadowserver Reported CnC Server Port 9000 Group 1 (botcc.portgrouped.rules) 2405044 - ProApps CNC Shadowserver Reported CnC Server Port 10324 Group 1 (botcc.portgrouped.rules) 2405045 - ProApps CNC Shadowserver Reported CnC Server Port 11830 Group 1 (botcc.portgrouped.rules) 2405046 - ProApps CNC Shadowserver Reported CnC Server Port 13001 Group 1 (botcc.portgrouped.rules) 2405047 - ProApps CNC Shadowserver Reported CnC Server Port 15000 Group 1 (botcc.portgrouped.rules) 2405048 - ProApps CNC Shadowserver Reported CnC Server Port 19899 Group 1 (botcc.portgrouped.rules) 2405049 - ProApps CNC Shadowserver Reported CnC Server Port 33333 Group 1 (botcc.portgrouped.rules) 2821563 - ProApps TROJAN iSpy Keylogger Reporting Infection via SMTP M2 (trojan.rules) 2821564 - ProApps TROJAN MSIL/Unknown Facebook Stealer Activiy (trojan.rules) 2821565 - ProApps POLICY External IP Address Lookup - ip-address.domaintools.com (policy.rules) 2821566 - ProApps TROJAN Unknown CnC Beacon (trojan.rules) 2821567 - ProApps TROJAN Malicious SSL certificate detected (Ursnif Injects) (trojan.rules) 2821568 - ProApps TROJAN Possible Ursnif Injects Domain in SNI (trojan.rules) 2821569 - ProApps TROJAN Locky CnC checkin Aug 03 2016 M2 (trojan.rules) 2821570 - ProApps WEB_CLIENT Microsoft Internet Explorer Possible Memory Corruption Vulnerability (CVE-2016-3288) SET (web_client.rules) 2821571 - ProApps WEB_CLIENT Microsoft Internet Explorer Possible Memory Corruption Vulnerability (CVE-2016-3288) (web_client.rules) 2821572 - ProApps WEB_CLIENT Microsoft Internet Explorer Possible Memory Corruption Vulnerability (CVE-2016-3289) (web_client.rules) 2821573 - ProApps WEB_CLIENT Microsoft Internet Explorer Possible Memory Corruption Vulnerability (CVE-2016-3290) (web_client.rules) 2821574 - ProApps EXPLOIT Microsoft Edge Browser RCE (CVE-2016-3293) (exploit.rules) 2821575 - ProApps EXPLOIT Microsoft Windows Possible win32kfull Out Of Bound Memory Access Executable Inbound (CVE-2016-3308) (exploit.rules) 2821576 - ProApps EXPLOIT Microsoft Windows Possible gdi32 Out Of Bound Memory Access Executable Inbound (CVE-2016-3309) (exploit.rules) 2821577 - ProApps EXPLOIT Microsoft Windows Possible Out Of Bound Memory Access Executable Inbound (CVE-2016-3310) (exploit.rules) 2821578 - ProApps EXPLOIT Microsoft Windows Win32k Privilege Elevation Vulnerability (CVE-2016-3311) (exploit.rules) 2821579 - ProApps WEB_CLIENT Microsoft Internet Explorer Possible Information Disclosure Vulnerability (CVE-2016-3321) (web_client.rules) 2821580 - ProApps WEB_CLIENT Microsoft Internet Explorer Use After Free (CVE-2016-3322) (web_client.rules) 2821581 - ProApps WEB_CLIENT Microsoft Internet Explorer Information Disclosure Vulnerability M1 (CVE-2016-3327) (web_client.rules) 2821582 - ProApps WEB_CLIENT Microsoft Internet Explorer Information Disclosure Vulnerability M2 (CVE-2016-3327) (web_client.rules) 2821583 - ProApps WEB_CLIENT Microsoft Internet Explorer Information Disclosure Vulnerability M3 (CVE-2016-3327) (web_client.rules) 2821584 - ProApps WEB_CLIENT Microsoft Internet Explorer Information Disclosure Vulnerability M4 (CVE-2016-3327) (web_client.rules) 2821585 - ProApps MOBILE_MALWARE Trojan-Ransom.AndroidOS.Congur.al Checkin (mobile_malware.rules) 2821586 - ProApps MOBILE_MALWARE AdWare.AndroidOS.Inoco.f Checkin (mobile_malware.rules) 2821587 - ProApps TROJAN PoisonIvy Keepalive to CnC 470 (trojan.rules) 2821588 - ProApps TROJAN Unknown .onion Proxy Domain (trojan.rules) [+++] Modify rules: 106 [+++] 2008438 - ProApps MALWARE Possible Windows executable sent when remote host claims to send a Text File (malware.rules) 2009897 - ProApps MALWARE Possible Windows executable sent when remote host claims to send html content (malware.rules) 2009909 - ProApps TROJAN Possible Windows executable sent when remote host claims to send HTML/CSS Content (trojan.rules) 2013800 - ProApps POLICY Outgoing Chromoting Session Response (policy.rules) 2013801 - ProApps POLICY Incoming Chromoting Session Response (policy.rules) 2023018 - ProApps TELNET SUSPICIOUS busybox enable (telnet.rules) 2402000 - ProApps DROP Dshield Block Listed Source group 1 (dshield.rules) 2403300 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 1 (ciarmy.rules) 2403301 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 2 (ciarmy.rules) 2403302 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 3 (ciarmy.rules) 2403303 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 4 (ciarmy.rules) 2403304 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 5 (ciarmy.rules) 2403305 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 6 (ciarmy.rules) 2403306 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 7 (ciarmy.rules) 2403307 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 8 (ciarmy.rules) 2403308 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 9 (ciarmy.rules) 2403309 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 10 (ciarmy.rules) 2403310 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 11 (ciarmy.rules) 2403311 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 12 (ciarmy.rules) 2403312 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 13 (ciarmy.rules) 2403313 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 14 (ciarmy.rules) 2403314 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 15 (ciarmy.rules) 2403315 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 16 (ciarmy.rules) 2403316 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 17 (ciarmy.rules) 2403317 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 18 (ciarmy.rules) 2403318 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 19 (ciarmy.rules) 2403319 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 20 (ciarmy.rules) 2403320 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 21 (ciarmy.rules) 2403321 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 22 (ciarmy.rules) 2403322 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 23 (ciarmy.rules) 2403323 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 24 (ciarmy.rules) 2403324 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 25 (ciarmy.rules) 2403325 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 26 (ciarmy.rules) 2403326 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 27 (ciarmy.rules) 2403327 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 28 (ciarmy.rules) 2403328 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 29 (ciarmy.rules) 2403329 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 30 (ciarmy.rules) 2403330 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 31 (ciarmy.rules) 2403331 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 32 (ciarmy.rules) 2403332 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 33 (ciarmy.rules) 2403333 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 34 (ciarmy.rules) 2403334 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 35 (ciarmy.rules) 2403335 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 36 (ciarmy.rules) 2403336 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 37 (ciarmy.rules) 2403337 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 38 (ciarmy.rules) 2403338 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 39 (ciarmy.rules) 2403339 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 40 (ciarmy.rules) 2403340 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 41 (ciarmy.rules) 2403341 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 42 (ciarmy.rules) 2403342 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 43 (ciarmy.rules) 2403343 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 44 (ciarmy.rules) 2403344 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 45 (ciarmy.rules) 2403345 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 46 (ciarmy.rules) 2403346 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 47 (ciarmy.rules) 2403347 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 48 (ciarmy.rules) 2403348 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 49 (ciarmy.rules) 2403349 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 50 (ciarmy.rules) 2403350 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 51 (ciarmy.rules) 2403351 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 52 (ciarmy.rules) 2403352 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 53 (ciarmy.rules) 2403353 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 54 (ciarmy.rules) 2403354 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 55 (ciarmy.rules) 2403355 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 56 (ciarmy.rules) 2403356 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 57 (ciarmy.rules) 2403357 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 58 (ciarmy.rules) 2403358 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 59 (ciarmy.rules) 2405000 - ProApps CNC Shadowserver Reported CnC Server Port 22 Group 1 (botcc.portgrouped.rules) 2405001 - ProApps CNC Shadowserver Reported CnC Server Port 80 Group 1 (botcc.portgrouped.rules) 2405002 - ProApps CNC Shadowserver Reported CnC Server Port 81 Group 1 (botcc.portgrouped.rules) 2405003 - ProApps CNC Shadowserver Reported CnC Server Port 443 Group 1 (botcc.portgrouped.rules) 2405004 - ProApps CNC Shadowserver Reported CnC Server Port 444 Group 1 (botcc.portgrouped.rules) 2405005 - ProApps CNC Shadowserver Reported CnC Server Port 1023 Group 1 (botcc.portgrouped.rules) 2405006 - ProApps CNC Shadowserver Reported CnC Server Port 1337 Group 1 (botcc.portgrouped.rules) 2405007 - ProApps CNC Shadowserver Reported CnC Server Port 2319 Group 1 (botcc.portgrouped.rules) 2405008 - ProApps CNC Shadowserver Reported CnC Server Port 3211 Group 1 (botcc.portgrouped.rules) 2405009 - ProApps CNC Shadowserver Reported CnC Server Port 3303 Group 1 (botcc.portgrouped.rules) 2405010 - ProApps CNC Shadowserver Reported CnC Server Port 3306 Group 1 (botcc.portgrouped.rules) 2405011 - ProApps CNC Shadowserver Reported CnC Server Port 4042 Group 1 (botcc.portgrouped.rules) 2405012 - ProApps CNC Shadowserver Reported CnC Server Port 4244 Group 1 (botcc.portgrouped.rules) 2405013 - ProApps CNC Shadowserver Reported CnC Server Port 4466 Group 1 (botcc.portgrouped.rules) 2405014 - ProApps CNC Shadowserver Reported CnC Server Port 5050 Group 1 (botcc.portgrouped.rules) 2405015 - ProApps CNC Shadowserver Reported CnC Server Port 6556 Group 1 (botcc.portgrouped.rules) 2405016 - ProApps CNC Shadowserver Reported CnC Server Port 6660 Group 1 (botcc.portgrouped.rules) 2405017 - ProApps CNC Shadowserver Reported CnC Server Port 6662 Group 1 (botcc.portgrouped.rules) 2405018 - ProApps CNC Shadowserver Reported CnC Server Port 6663 Group 1 (botcc.portgrouped.rules) 2405019 - ProApps CNC Shadowserver Reported CnC Server Port 6664 Group 1 (botcc.portgrouped.rules) 2405020 - ProApps CNC Shadowserver Reported CnC Server Port 6665 Group 1 (botcc.portgrouped.rules) 2405021 - ProApps CNC Shadowserver Reported CnC Server Port 6666 Group 1 (botcc.portgrouped.rules) 2405022 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 1 (botcc.portgrouped.rules) 2405023 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 2 (botcc.portgrouped.rules) 2405024 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 3 (botcc.portgrouped.rules) 2405025 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 4 (botcc.portgrouped.rules) 2405026 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 5 (botcc.portgrouped.rules) 2405027 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 6 (botcc.portgrouped.rules) 2405028 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 7 (botcc.portgrouped.rules) 2405029 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 8 (botcc.portgrouped.rules) 2405030 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 9 (botcc.portgrouped.rules) 2405031 - ProApps CNC Shadowserver Reported CnC Server Port 6667 Group 10 (botcc.portgrouped.rules) 2405032 - ProApps CNC Shadowserver Reported CnC Server Port 6668 Group 1 (botcc.portgrouped.rules) 2405033 - ProApps CNC Shadowserver Reported CnC Server Port 6669 Group 1 (botcc.portgrouped.rules) 2405034 - ProApps CNC Shadowserver Reported CnC Server Port 6677 Group 1 (botcc.portgrouped.rules) 2405035 - ProApps CNC Shadowserver Reported CnC Server Port 6768 Group 1 (botcc.portgrouped.rules) 2405036 - ProApps CNC Shadowserver Reported CnC Server Port 6900 Group 1 (botcc.portgrouped.rules) 2811686 - ProApps CURRENT_EVENTS SUSPICIOUS Encoded Plugin Detect (Previously observed in ScanBox) (current_events.rules) 2821358 - ProApps TROJAN AZORult Variant Checkin (trojan.rules) 2821424 - ProApps TROJAN Win32/Daserf CnC Beacon 1 (trojan.rules) [+++] Removed rules: 13 [+++] 2403359 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 60 (ciarmy.rules) 2403360 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 61 (ciarmy.rules) 2403361 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 62 (ciarmy.rules) 2403362 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 63 (ciarmy.rules) 2403363 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 64 (ciarmy.rules) 2403364 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 65 (ciarmy.rules) 2403365 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 66 (ciarmy.rules) 2403366 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 67 (ciarmy.rules) 2403367 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 68 (ciarmy.rules) 2403368 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 69 (ciarmy.rules) 2403369 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 70 (ciarmy.rules) 2403370 - ProApps CINS Active Threat Intelligence Poor Reputation IP group 71 (ciarmy.rules) 2821560 - ProApps TROJAN Unknown CnC Beacon (hardcoded HTTP headers) (trojan.rules) | |
Comentários (0)