Ruleset Update Summary - 2026/08/03 - v11248

Ruleset Updates
1

Summary:

10 new OPEN, 28 new PRO (10 + 18)

Added rules:

Open:

  • 2071358 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (matchny .cyou) (malware.rules)
  • 2071359 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (matchny .cyou) in TLS SNI (malware.rules)
  • 2071360 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (perfoxd .xyz) (malware.rules)
  • 2071361 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (perfoxd .xyz) in TLS SNI (malware.rules)
  • 2071362 - ET HUNTING FTP (passive) LIST Response NUL Byte After Timestamp (hunting.rules)
  • 2071363 - ET WEB_SPECIFIC_APPS W3 Total Cache admin-post.php browsercache__security__xfo__allow Parameter Remote Code Execution Attempt (CVE-2026-57623) (web_specific_apps.rules)
  • 2071364 - ET HUNTING FTP (active) LIST Response NUL Byte After Timestamp (hunting.rules)
  • 2071365 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bizsmmit .cyou) (malware.rules)
  • 2071366 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bizsmmit .cyou) in TLS SNI (malware.rules)
  • 2071367 - ET WEB_SPECIFIC_APPS Flowise chatflows id Parameter Directory Traversal Attempt (CVE-2025-71334) (web_specific_apps.rules)

Pro:

  • 2868113 - ETPRO HUNTING Laravel Excessively Large Cookie in HTTP Request (hunting.rules)
  • 2868114 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868115 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868116 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868117 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868118 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868119 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868120 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868121 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868122 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868123 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868124 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868125 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868126 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868127 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868128 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868129 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868130 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)