Re: new emotet campain

2019-09-17 Thread Amir Caspi
On Sep 17, 2019, at 12:15 PM, John Hardin wrote: > > On Tue, 17 Sep 2019, hg user wrote: > >> It is a "dumb" rule but the quicker I could create. >> >> https://pastebin.com/bxRSds7a > > Suggestions: > > (1) use a URI rule rather than a BODY rule > > (2) escape the periods; you want to match

Re: new emotet campain

2019-09-17 Thread John Hardin
On Tue, 17 Sep 2019, hg user wrote: It is a "dumb" rule but the quicker I could create. https://pastebin.com/bxRSds7a Suggestions: (1) use a URI rule rather than a BODY rule (2) escape the periods; you want to match a period, not any-character. On Tue, Sep 17, 2019 at 11:59 AM Blason R

Re: new emotet campain

2019-09-17 Thread hg user
these rules are from "epoch 2" campain and according to the docs are included in the email... as far as i understand i don't have clamav active in this moment On Tuesday, September 17, 2019, Axb wrote: > I doubt you'll see many hits on that rule as I'd expect most URIS being > included in t

Re: new emotet campain

2019-09-17 Thread Axb
I doubt you'll see many hits on that rule as I'd expect most URIS being included in the infected attachments. Imo, the ClamAV sigs make more sense. On 9/17/19 12:36 PM, hg user wrote: It is a "dumb" rule but the quicker I could create. https://pastebin.com/bxRSds7a On Tue, Sep 17, 2019 at 11:

Re: new emotet campain

2019-09-17 Thread hg user
It is a "dumb" rule but the quicker I could create. https://pastebin.com/bxRSds7a On Tue, Sep 17, 2019 at 11:59 AM Blason R wrote: > If possible please share it here? > > On Tue, Sep 17, 2019 at 3:20 PM hg user wrote: > >> A new emotet campain is in progress (https://twitter.com/Cryptolaemus1)

Re: new emotet campain

2019-09-17 Thread Riccardo Alfieri
On 17/09/19 11:59, Blason R wrote: If possible please share it here? On Tue, Sep 17, 2019 at 3:20 PM hg user > wrote: A new emotet campain is in progress (https://twitter.com/Cryptolaemus1) and I created a rule... I don't know if is it possible to s

Re: new emotet campain

2019-09-17 Thread Blason R
If possible please share it here? On Tue, Sep 17, 2019 at 3:20 PM hg user wrote: > A new emotet campain is in progress (https://twitter.com/Cryptolaemus1) > and I created a rule... I don't know if is it possible to share (via > pastebin) the rule I created to have feedback from the experts... >

new emotet campain

2019-09-17 Thread hg user
A new emotet campain is in progress (https://twitter.com/Cryptolaemus1) and I created a rule... I don't know if is it possible to share (via pastebin) the rule I created to have feedback from the experts...