Ruleset Update Summary - 2026/07/16 - v11235

Ruleset Updates
1

Summary:

16 new OPEN, 52 new PRO (16 + 36)

Added rules:

Open:

  • 2071198 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (screenconnect .com) (info.rules)
  • 2071199 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (connectwise .com) (info.rules)
  • 2071200 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (screenconnect .com) (info.rules)
  • 2071201 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (connectwise .com) (info.rules)
  • 2071202 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (check .screenconnect .com) (info.rules)
  • 2071203 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (check .screenconnect .com) (info.rules)
  • 2071204 - ET INFO Remote Monitoring and Management (RMM) Tools in DNS Lookup (getscreen .me) (info.rules)
  • 2071205 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (getscreen .me) (info.rules)
  • 2071206 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (bitista .icu) (exploit_kit.rules)
  • 2071207 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (bitista .icu) (exploit_kit.rules)
  • 2071208 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img-eu .veranofund .com) (malware.rules)
  • 2071209 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img-eu .veranofund .com) (malware.rules)
  • 2071210 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (emberlattice .top) (exploit_kit.rules)
  • 2071211 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (kblaa .com) (exploit_kit.rules)
  • 2071212 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (emberlattice .top) (exploit_kit.rules)
  • 2071213 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (kblaa .com) (exploit_kit.rules)

Pro:

  • 2867981 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867982 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867983 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867984 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867985 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867986 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867987 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867988 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867989 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867990 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2867991 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2867992 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867993 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2867994 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2867995 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867996 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2867997 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867998 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867999 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868000 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868001 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868002 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868003 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868004 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868005 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868006 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868007 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868008 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868009 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868010 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868011 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868013 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868014 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868015 - ETPRO MALWARE UNK_SteadySplit CnC Beacon Activity (Outbound) (malware.rules)
  • 2868016 - ETPRO MALWARE UNK_SteadySplit CnC Beacon Activity (Inbound) (malware.rules)