Ruleset Update Summary - 2026/06/22 - v11218

Ruleset Updates
1

Summary:

20 new OPEN, 20 new PRO (20 + 0)

Added rules:

Open:

  • 2070014 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (highawaretemptersudwu .xyz) (malware.rules)
  • 2070015 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (highawaretemptersudwu .xyz) in TLS SNI (malware.rules)
  • 2070016 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mazefearcontainujsy .shop) (malware.rules)
  • 2070017 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mazefearcontainujsy .shop) in TLS SNI (malware.rules)
  • 2070018 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (souptapedentisttactiwe .shop) (malware.rules)
  • 2070019 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (souptapedentisttactiwe .shop) in TLS SNI (malware.rules)
  • 2070020 - ET INFO DYNAMIC_DNS Query to a *.npmpt .com domain (info.rules)
  • 2070021 - ET INFO DYNAMIC_DNS HTTP Request to a *.npmpt .com domain (info.rules)
  • 2070022 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (almontm .xyz) (exploit_kit.rules)
  • 2070023 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (almontm .xyz) (exploit_kit.rules)
  • 2070024 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (ivorycompass .top) (exploit_kit.rules)
  • 2070025 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (ivorycompass .top) (exploit_kit.rules)
  • 2070026 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (gallery .garrettcountygranfondo .org) (malware.rules)
  • 2070027 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (gallery .garrettcountygranfondo .org) (malware.rules)
  • 2070028 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aculpr .xyz) (malware.rules)
  • 2070029 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (aculpr .xyz) in TLS SNI (malware.rules)
  • 2070030 - ET MALWARE GoldenGh0stLoader CnC Domain in DNS Lookup (goldeyeuu .io) (malware.rules)
  • 2070031 - ET MALWARE GoldenGh0stLoader Directory Listing Command From C2 (malware.rules)
  • 2070032 - ET MALWARE GoldenGh0stLoader Websocket Checkin - C2 Response (malware.rules)
  • 2070033 - ET USER_AGENTS Automox User-Agent Observed (ax-dcu-powershell) (user_agents.rules)

Modified inactive rules:

  • 2069434 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (silentquarry .top) (exploit_kit.rules)