Ruleset Update Summary - 2026/07/21 - v11238

Ruleset Updates
1

Summary:

9 new OPEN, 12 new PRO (9 + 3)

Added rules:

Open:

  • 2071235 - ET WEB_SPECIFIC_APPS SonicWall SMA Websocket Tunnel Bypass (CVE-2026-15409) (web_specific_apps.rules)
  • 2071236 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (meduurst .space) (exploit_kit.rules)
  • 2071237 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (meduurst .space) (exploit_kit.rules)
  • 2071238 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img2 .mekebibsolomonlaw .com) (malware.rules)
  • 2071239 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img2 .mekebibsolomonlaw .com) (malware.rules)
  • 2071240 - ET WEB_SPECIFIC_APPS Esri ArcGIS Server Unauthenticated Path Traversal in UploadsManager (CVE-2026-9181) (web_specific_apps.rules)
  • 2071241 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (choppyi .cyou) (malware.rules)
  • 2071242 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (choppyi .cyou) in TLS SNI (malware.rules)
  • 2071249 - ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration (scan.rules)

Pro:

  • 2868019 - ETPRO WEB_SPECIFIC_APPS PTC Windchill/FlexPLM Unauthenticated Remote Code Execution (CVE-2026-12569) (web_specific_apps.rules)
  • 2868020 - ETPRO PHISHING Generic Device Code Phish Landing Page M1 2026-07-21 (phishing.rules)
  • 2868021 - ETPRO PHISHING Generic Device Code Phish Landing Page M2 2026-07-21 (phishing.rules)