Ruleset Update Summary - 2026/07/23 - v11240

Ruleset Updates
1

Summary:

9 new OPEN, 37 new PRO (9 + 28)

Added rules:

Open:

  • 2071268 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appallf .pics) (malware.rules)
  • 2071269 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (appallf .pics) in TLS SNI (malware.rules)
  • 2071270 - ET WEB_SPECIFIC_APPS XWiki Groovy Script Command Injection Attempt M2 (CVE-2024-31982) (web_specific_apps.rules)
  • 2071271 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (barringer .click) (exploit_kit.rules)
  • 2071272 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (riccardson .click) (exploit_kit.rules)
  • 2071273 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (barringer .click) (exploit_kit.rules)
  • 2071274 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (riccardson .click) (exploit_kit.rules)
  • 2071275 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (api-store .urgaacoffeeroastery .com) (malware.rules)
  • 2071276 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (api-store .urgaacoffeeroastery .com) (malware.rules)

Pro:

  • 2868023 - ETPRO PHISHING EvilTokens Landing Page 2026-07-22 (phishing.rules)
  • 2868024 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868025 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868026 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868027 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868028 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868029 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868030 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868031 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868032 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868033 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868034 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868035 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868036 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868037 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868038 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868039 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868040 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868041 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868042 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868043 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868044 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868045 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868046 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868047 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868048 - ETPRO PHISHING EvilTokens Gate Check (phishing.rules)
  • 2868049 - ETPRO PHISHING EvilTokens Gate Check Response (phishing.rules)
  • 2868050 - ETPRO PHISHING EvilTokens Visitor Fingerprint (phishing.rules)

Modified inactive rules:

  • 2867918 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)