Ruleset Update Summary - 2026/07/07 - v11228

Ruleset Updates
1

Summary:

9 new OPEN, 19 new PRO (9 + 10)

Added rules:

Open:

  • 2071115 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (lombaidi .lol) (exploit_kit.rules)
  • 2071116 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (robests .lol) (exploit_kit.rules)
  • 2071117 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (lombaidi .lol) (exploit_kit.rules)
  • 2071118 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (robests .lol) (exploit_kit.rules)
  • 2071119 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (in-us .leadmarketingmachine .com) (malware.rules)
  • 2071120 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (in-us .leadmarketingmachine .com) (malware.rules)
  • 2071121 - ET ATTACK_RESPONSE IceCube JS Backdoor Payload (attack_response.rules)
  • 2071122 - ET MALWARE IceCube JS Backdoor C2 Logging (malware.rules)
  • 2071123 - ET MALWARE IceCube JS Backdoor C2 Collect Info (malware.rules)

Pro:

  • 2867924 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867925 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867926 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867927 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867928 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867929 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867930 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867931 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867932 - ETPRO MALWARE UNK_TransparentTribe CnC Beacon M1 (malware.rules)
  • 2867933 - ETPRO MALWARE UNK_TransparentTribe CnC Beacon M2 (malware.rules)