From 87404ea1e1ee062ed7227d82c232efdeb9cee2db Mon Sep 17 00:00:00 2001 From: "Mohamed Ashraf (X__Junior)" Date: Mon, 20 Mar 2023 17:41:13 +0200 Subject: [PATCH] Update proxy_ua_malware.yml --- rules/web/proxy_generic/proxy_ua_malware.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/rules/web/proxy_generic/proxy_ua_malware.yml b/rules/web/proxy_generic/proxy_ua_malware.yml index 79641392e..a75b85862 100644 --- a/rules/web/proxy_generic/proxy_ua_malware.yml +++ b/rules/web/proxy_generic/proxy_ua_malware.yml @@ -92,6 +92,22 @@ detection: - 'qwrqrwrqwrqwr' # Racoon Stealer - 'rc2.0/client' # Racoon Stealer - 'TakeMyPainBack' # Racoon Stealer + - 'xxx' # Racoon Stealer + - '20112211' # Racoon Stealer + - '23591' # Racoon Stealer + - '901785252112' # Racoon Stealer + - '1235125521512' # Racoon Stealer + - '125122112551' # Racoon Stealer + - 'B1D3N_RIM_MY_ASS' # Racoon Stealer + - 'Ares_ldr_v_*' # AresLoader + # - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:106.0) Gecko/20100101 Firefox/106' # seen used by AresLoader + - 'Microsoft Internet Explorer' # https://github.com/silence-is-best/c2db + - 'CLCTR' # https://github.com/silence-is-best/c2db + - 'uploader' # https://github.com/silence-is-best/c2db + - 'agent' # https://github.com/silence-is-best/c2db + - 'License' # https://github.com/silence-is-best/c2db + - 'vb wininet' # https://github.com/silence-is-best/c2db + - 'Client' # https://github.com/silence-is-best/c2db condition: selection fields: - ClientIP