Ruleset Update Summary - 2026/07/15 - v11234

Ruleset Updates
1

Summary:

8 new OPEN, 11 new PRO (8 + 3)

Added rules:

Open:

  • 2071190 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (free-api .travelaccex .com) (malware.rules)
  • 2071191 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (free-api .travelaccex .com) (malware.rules)
  • 2071192 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (alabastercompass .top) (exploit_kit.rules)
  • 2071193 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (granitehearth .top) (exploit_kit.rules)
  • 2071194 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (alabastercompass .top) (exploit_kit.rules)
  • 2071195 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (granitehearth .top) (exploit_kit.rules)
  • 2071196 - ET INFO DYNAMIC_DNS Query to a *.blogs .or .id domain (info.rules)
  • 2071197 - ET INFO DYNAMIC_DNS HTTP Request to a *.blogs .or .id domain (info.rules)

Pro:

  • 2867977 - ETPRO EXPLOIT Windows DHCP Server Heap Overflow (CVE-2026-50518) (exploit.rules)
  • 2867978 - ETPRO WEB_SPECIFIC_APPS Microsoft Sharepoint Unauthenticated Remote Code Execution (CVE-2026-50522) (web_specific_apps.rules)
  • 2867979 - ETPRO HUNTING Suspicious POST to cmd URI (hunting.rules)