Ruleset Update Summary - 2025/09/26 - v11025

Ruleset Updates
1

Summary:

9 new OPEN, 9 new PRO (9 + 0)

Added rules:

Open:

  • 2064934 - ET HUNTING SonicWall Email Security Unauthenticated Arbitrary User Creation (CVE-2021-20021) M1 (hunting.rules)
  • 2064935 - ET HUNTING SonicWall Email Security Unauthenticated Arbitrary User Creation (CVE-2021-20021) M2 (hunting.rules)
  • 2064936 - ET WEB_SPECIFIC_APPS SonicWall Email Security Authenticated Directory Traversal in Branding Feature (CVE-2021-20023) (web_specific_apps.rules)
  • 2064937 - ET WEB_SPECIFIC_APPS Palo Alto Expedition OS Command Injection (CVE-2025-0107) (web_specific_apps.rules)
  • 2064938 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slabbymenusportef .pw) (malware.rules)
  • 2064939 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (slabbymenusportef .pw) in TLS SNI (malware.rules)
  • 2064940 - ET WEB_SPECIFIC_APPS Palo Alto PAN-OS Reflected Cross-Site Scripting (CVE-2025-0133) (web_specific_apps.rules)
  • 2064941 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (morniksell .com) (exploit_kit.rules)
  • 2064942 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (morniksell .com) (exploit_kit.rules)

Modified inactive rules:

  • 2832745 - ETPRO MOBILE_MALWARE Trojan-Banker.AndroidOS.Asacub.a Checkin 431 (mobile_malware.rules)
  • 2832746 - ETPRO MOBILE_MALWARE Trojan-Banker.AndroidOS.Asacub.a Checkin 432 (mobile_malware.rules)
  • 2833804 - ETPRO MALWARE PS.APT.PhishDoc.TR Checkin 2 (malware.rules)
  • 2834101 - ETPRO MALWARE MSIL/Murkios Bot CnC Keep-Alive (malware.rules)