Ruleset Update Summary - 2026/05/29 - v11203

Ruleset Updates
1

Summary:

3 new OPEN, 6 new PRO (3 + 3)

Added rules:

Open:

  • 2069478 - ET MALWARE Glassworm CnC Activity (CrowdStrike Sinkhole) (malware.rules)
  • 2069479 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cpanel .prestigefinancialrebuilders .com) (malware.rules)
  • 2069480 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cpanel .prestigefinancialrebuilders .com) (malware.rules)

Pro:

  • 2867590 - ETPRO EXPLOIT Apache Ignite Unauthenticated Discovery SPI RCE via Insecure Deserialization (CVE-2024-52577) (exploit.rules)
  • 2867591 - ETPRO WEB_SPECIFIC_APPS dotCMS Core Publish Audit API SQL Injection (CVE-2026-8054) (web_specific_apps.rules)
  • 2867592 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)

Modified inactive rules:

  • 2069427 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (crystalrocketlab .top) (exploit_kit.rules)