Ruleset Update Summary - 2026/07/08 - v11229

Ruleset Updates
1

Summary:

8 new OPEN, 9 new PRO (8 + 1)

Added rules:

Open:

  • 2071124 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (azevedo .lol) (exploit_kit.rules)
  • 2071125 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (fraitas .lol) (exploit_kit.rules)
  • 2071126 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (azevedo .lol) (exploit_kit.rules)
  • 2071127 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (fraitas .lol) (exploit_kit.rules)
  • 2071128 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img-slow .alternativesynergies .com) (malware.rules)
  • 2071129 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img-slow .alternativesynergies .com) (malware.rules)
  • 2071130 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (marblecourier .top) (exploit_kit.rules)
  • 2071131 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (marblecourier .top) (exploit_kit.rules)

Pro:

  • 2867934 - ETPRO WEB_SPECIFIC_APPS Oracle E-Business Suite Unauthenticated Remote Takeover of Oracle Payments (CVE-2026-46817) (web_specific_apps.rules)

Disabled and modified rules:

  • 2867915 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867917 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867918 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867921 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867923 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)