Ruleset Update Summary - 2026/07/14 - v11233

Ruleset Updates
1

Summary:

8 new OPEN, 22 new PRO (8 + 14)

Added rules:

Open:

  • 2071182 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (ritchie .click) (exploit_kit.rules)
  • 2071183 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (ritchie .click) (exploit_kit.rules)
  • 2071184 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (images .miamionly .com) (malware.rules)
  • 2071185 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (images .miamionly .com) (malware.rules)
  • 2071186 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (hazelcitadel .top) (exploit_kit.rules)
  • 2071187 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (moonlitprovince .top) (exploit_kit.rules)
  • 2071188 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (hazelcitadel .top) (exploit_kit.rules)
  • 2071189 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (moonlitprovince .top) (exploit_kit.rules)

Pro:

  • 2867963 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2867964 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2867965 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2867966 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2867967 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2867968 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2867969 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2867970 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2867971 - ETPRO INFO Palo Alto PAN-OS GlobalProtect Authentication Success (prelogin.esp) (info.rules)
  • 2867972 - ETPRO INFO Palo Alto PAN-OS GlobalProtect Authentication Success (getconfig.esp) (info.rules)
  • 2867973 - ETPRO INFO Palo Alto PAN-OS GlobalProtect Authentication Success (login.esp) (info.rules)
  • 2867974 - ETPRO EXPLOIT Palo Alto PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) (exploit.rules)
  • 2867975 - ETPRO WEB_SPECIFIC_APPS RabbitMQ Unauthenticated OAuth client-secret Disclosure Request (CVE-2026-57219) (web_specific_apps.rules)
  • 2867976 - ETPRO WEB_SPECIFIC_APPS RabbitMQ Unauthenticated OAuth client-secret Disclosure Response (CVE-2026-57219) (web_specific_apps.rules)

Modified inactive rules:

  • 2002924 - ET EXPLOIT VNC Server Not Requiring Authentication (exploit.rules)