Ruleset Update Summary - 2026/07/20 - v11237

Ruleset Updates
1

Summary:

7 new OPEN, 7 new PRO (7 + 0)

Added rules:

Open:

  • 2071228 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (meltedpleasandtws .shop) (malware.rules)
  • 2071229 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (meltedpleasandtws .shop) in TLS SNI (malware.rules)
  • 2071230 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (deckerh .cyou) (malware.rules)
  • 2071231 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (deckerh .cyou) in TLS SNI (malware.rules)
  • 2071232 - ET INFO NGrok Skip Browser Warning Header (info.rules)
  • 2071233 - ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030) M1 (web_specific_apps.rules)
  • 2071234 - ET WEB_SPECIFIC_APPS WordPress Core wp2shell Remote Code Execution (CVE-2026-63030) M2 (web_specific_apps.rules)

Modified inactive rules:

  • 2867921 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)