Ruleset Update Summary - 2026/02/12 - v11124

Ruleset Updates
1

Summary:

15 new OPEN, 17 new PRO (15 + 2)

Added rules:

Open:

  • 2067634 - ET INFO DYNAMIC_DNS Query to a *.rocketpride .com domain (info.rules)
  • 2067635 - ET INFO DYNAMIC_DNS HTTP Request to a *.rocketpride .com domain (info.rules)
  • 2067636 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (netzhit .com) (exploit_kit.rules)
  • 2067637 - ET EXPLOIT_KIT LandUpdate808 Domain (netzhit .com) in TLS SNI (exploit_kit.rules)
  • 2067638 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mixermixedo .click) (malware.rules)
  • 2067639 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mixermixedo .click) in TLS SNI (malware.rules)
  • 2067640 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (retiriu .cyou) (malware.rules)
  • 2067641 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (retiriu .cyou) in TLS SNI (malware.rules)
  • 2067642 - ET HUNTING HTTP Permissions-Policy Geolocation Directive (hunting.rules)
  • 2067643 - ET MALWARE Observed TinyNuke Payload Request (GET) (malware.rules)
  • 2067644 - ET MALWARE Observed StealC Payload Request (GET) (malware.rules)
  • 2067645 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (sonyj .com) (exploit_kit.rules)
  • 2067646 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (sonyj .com) (exploit_kit.rules)
  • 2067647 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (booking .lastminutebusinessclass .com) (malware.rules)
  • 2067648 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (booking .lastminutebusinessclass .com) (malware.rules)

Pro:

  • 2866038 - ETPRO MALWARE Observed DNS Query to UNK_MirageMaze Domain (malware.rules)
  • 2866039 - ETPRO MALWARE Observed UNK_MirageMaze Domain in TLS SNI (malware.rules)

Modified inactive rules:

  • 2020581 - ET MALWARE Chanitor .onion Proxy Domain (malware.rules)
  • 2021063 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC) (malware.rules)
  • 2021702 - ET GAMES MINECRAFT Server response outbound (games.rules)
  • 2810754 - ETPRO MALWARE Trojan-Banker.Win32.Banbra.dou Checkin (malware.rules)
  • 2811656 - ETPRO EXPLOIT_KIT SunDown EK Landing June 23 2015 (exploit_kit.rules)