Ruleset Update Summary - 2026/06/15 - v11214

Ruleset Updates
1

Summary:

14 new OPEN, 19 new PRO (14 + 5)

Added rules:

Open:

  • 2069929 - ET WEB_SPECIFIC_APPS Splunk Enterprise PostgreSQL Sidecar Service API via SplunkWeb Arbitrary File Create (CVE-2026-20253) (web_specific_apps.rules)
  • 2069930 - ET WEB_SPECIFIC_APPS Splunk Enterprise PostgreSQL Sidecar Service API via SplunkWeb Parameter Injection (CVE-2026-20253) (web_specific_apps.rules)
  • 2069937 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (dl .erickillorinphotostore .com) (malware.rules)
  • 2069938 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (files .smartpcai .com) (malware.rules)
  • 2069939 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (dl .erickillorinphotostore .com) (malware.rules)
  • 2069940 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (files .smartpcai .com) (malware.rules)
  • 2069941 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (divinenarratives .org) (exploit_kit.rules)
  • 2069942 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (divinenarratives .org) (exploit_kit.rules)
  • 2069943 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (eichmnnn .icu) (exploit_kit.rules)
  • 2069944 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (eichmnnn .icu) (exploit_kit.rules)
  • 2069945 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mulchga .cyou) (malware.rules)
  • 2069946 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mulchga .cyou) in TLS SNI (malware.rules)
  • 2069947 - ET EXPLOIT_KIT tdsshop Inject Script M1 (exploit_kit.rules)
  • 2069948 - ET EXPLOIT_KIT tdsshop Inject Script M2 (exploit_kit.rules)

Pro:

  • 2867719 - ETPRO PHISHING UNK_SmokeScreen Fetch Victim Config (phishing.rules)
  • 2867720 - ETPRO PHISHING UNK_SmokeScreen Page View Tracking (phishing.rules)
  • 2867721 - ETPRO PHISHING Successful UNK_SmokeScreen Credential Phish (phishing.rules)
  • 2867722 - ETPRO HUNTING Splunk Enterprise REST API via SplunkWeb Request with Empty Basic Auth (hunting.rules)
  • 2867723 - ETPRO HUNTING Splunk Enterprise REST API via SplunkWeb Request with Default PostgreSQL Basic Auth (hunting.rules)