add lokibot

Author: nasbench

detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml

@@ -24,6 +24,7 @@ description: |
   * CastleRAT
   * Chafer
   * DCRAT
+  * LokiBot
   * Lumma Stealer
   * Nobelium
   * Quasar

lookups/cisco_snort_ids_to_threat_mapping.csv

@@ -31,6 +31,7 @@ DCRAT,64370,MALWARE-OTHER,Win.Trojan.DcRat variant download attempt
 DCRAT,64371,MALWARE-OTHER,Win.Trojan.DcRat variant download attempt
 DCRAT,64372,MALWARE-CNC,Win.Trojan.DcRat variant communication attempt
 DCRAT,64373,MALWARE-CNC,Win.Trojan.DcRat variant communication attempt
+LokiBot,65502,MALWARE-CNC,Win.Trojan.LokiBot variant outbound connection attempt
 Lumma Stealer,62709,MALWARE-CNC,Win.Malware.Lumma variant outbound connection
 Lumma Stealer,62710,MALWARE-OTHER,Win.Malware.Lumma variant download attempt
 Lumma Stealer,62711,MALWARE-OTHER,Win.Malware.Lumma variant download attempt
@@ -108,4 +109,4 @@ Xworm,62775,MALWARE-OTHER,Win.Trojan.Xworm download attempt
 Xworm,64185,MALWARE-CNC,Win.Dropper.Xworm variant inbound communication
 Xworm,64186,MALWARE-CNC,Win.Dropper.Xworm variant inbound communication
 Xworm,64187,MALWARE-OTHER,Win.Dropper.Xworm variant download attempt
-Xworm,64188,MALWARE-OTHER,Win.Dropper.Xworm variant download attempt
+Xworm,64188,MALWARE-OTHER,Win.Dropper.Xworm variant download attempt