Ruleset Update Summary - 2026/06/29 - v11223

Ruleset Updates
1

Summary:

28 new OPEN, 75 new PRO (28 + 47)

There will be no release Friday July 3rd.

Added rules:

Open:

  • 2070082 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (astrale .cyou) (malware.rules)
  • 2070083 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (astrale .cyou) in TLS SNI (malware.rules)
  • 2070084 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (auditva .cyou) (malware.rules)
  • 2070085 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (auditva .cyou) in TLS SNI (malware.rules)
  • 2070086 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (betavmt .cyou) (malware.rules)
  • 2070087 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (betavmt .cyou) in TLS SNI (malware.rules)
  • 2070088 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hiatuft .cyou) (malware.rules)
  • 2070089 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (hiatuft .cyou) in TLS SNI (malware.rules)
  • 2070090 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (myroayy .cyou) (malware.rules)
  • 2070091 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (myroayy .cyou) in TLS SNI (malware.rules)
  • 2070092 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nebulqj .cyou) (malware.rules)
  • 2070093 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (nebulqj .cyou) in TLS SNI (malware.rules)
  • 2070094 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (overcjo .cyou) (malware.rules)
  • 2070095 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (overcjo .cyou) in TLS SNI (malware.rules)
  • 2070096 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (turacpn .cyou) (malware.rules)
  • 2070097 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (turacpn .cyou) in TLS SNI (malware.rules)
  • 2070098 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (versesoffe .biz) (malware.rules)
  • 2070099 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (versesoffe .biz) in TLS SNI (malware.rules)
  • 2070100 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cportal .atlantascales .com) (malware.rules)
  • 2070101 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cportal .atlantascales .com) (malware.rules)
  • 2070102 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (bogisibh .xyz) (exploit_kit.rules)
  • 2070103 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (bogisibh .xyz) (exploit_kit.rules)
  • 2070104 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (ackeamann .xyz) (exploit_kit.rules)
  • 2070105 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (ackeamann .xyz) (exploit_kit.rules)
  • 2070106 - ET MALWARE Observed VenomRAT SSL Cert (malware.rules)
  • 2070107 - ET MALWARE Observed LMTeamRAT SSL Cert (malware.rules)
  • 2070108 - ET MALWARE Observed AlfaRedFox RAT SSL Cert (malware.rules)
  • 2070109 - ET MALWARE Observed DarkRAT SSL Cert (malware.rules)

Pro:

  • 2867813 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867814 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867815 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867816 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867817 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2867818 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867819 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2867820 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867821 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2867822 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867823 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867824 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2867825 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867826 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867827 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867828 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867829 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867830 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867831 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2867832 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2867833 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2867834 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2867835 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867836 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2867837 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867838 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2867839 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867840 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867841 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2867842 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867843 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867844 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867845 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867846 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867847 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867848 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2867849 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2867850 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2867851 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2867852 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867853 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2867854 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867855 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2867856 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867857 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867858 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2867859 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)