Ruleset Update Summary - 2026/07/22 - v11239

Ruleset Updates
1

Summary:

10 new OPEN, 10 new PRO (10 + 0)

Added rules:

Open:

  • 2071258 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (monterro .click) (exploit_kit.rules)
  • 2071259 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (monterro .click) (exploit_kit.rules)
  • 2071260 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cdn-js .tobaccobazaar .com) (malware.rules)
  • 2071261 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (prod-dl .vandornpharmacy .net) (malware.rules)
  • 2071262 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cdn-js .tobaccobazaar .com) (malware.rules)
  • 2071263 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (prod-dl .vandornpharmacy .net) (malware.rules)
  • 2071264 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (isctmasjid .org) (exploit_kit.rules)
  • 2071265 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (isctmasjid .org) (exploit_kit.rules)
  • 2071266 - ET WEB_SPECIFIC_APPS TP-Link WlanNetworkRpm.htm ssid Parameter Command Injection Attempt (CVE-2023-33538) (web_specific_apps.rules)
  • 2071267 - ET WEB_SPECIFIC_APPS Roundcube onanimationstart Cross Site Scripting Attempt (CVE-2024-42009) (web_specific_apps.rules)

Disabled and modified rules:

  • 2867998 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868002 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868007 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868014 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)