Ruleset Update Summary - 2026/08/06 - v11251

Ruleset Updates
1

Summary:

14 new OPEN, 14 new PRO (14 + 0)

Added rules:

Open:

  • 2071402 - ET INFO Ethereum Contract Request, getAll() (info.rules)
  • 2071403 - ET WEB_SPECIFIC_APPS F5 BIG-IP Authenticated Code Execution via .rpmspec Injection (CVE-2022-41800) (web_specific_apps.rules)
  • 2071404 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (urbarket .cyou) (malware.rules)
  • 2071405 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (urbarket .cyou) in TLS SNI (malware.rules)
  • 2071406 - ET WEB_SPECIFIC_APPS F5 BIG-IP SOAP API Unauthenticated Remote Code Execution via Cross-Site Request Forgery (CVE-2022-41622) (web_specific_apps.rules)
  • 2071407 - ET INFO Github CDN for Release Assets Domain in DNS Lookup (release-assets .githubusercontent .com) (info.rules)
  • 2071408 - ET INFO Github CDN for Release Assets Domain in TLS SNI (release-assets .githubusercontent .com) (info.rules)
  • 2071409 - ET MALWARE Havoc Demon CnC Domain in DNS Lookup (verifysecure .net) (malware.rules)
  • 2071410 - ET MALWARE Havoc Demon CnC Domain in DNS Lookup (bytedanceengine .top) (malware.rules)
  • 2071411 - ET MALWARE Havoc Demon CnC Domain in TLS SNI (verifysecure .net) (malware.rules)
  • 2071412 - ET MALWARE Havoc Demon CnC Domain in TLS SNI (bytedanceengine .top) (malware.rules)
  • 2071413 - ET WEB_SPECIFIC_APPS Arris list_mac_address.php Multiple Parameters Command Injection Attempt (web_specific_apps.rules)
  • 2071414 - ET WEB_SPECIFIC_APPS Arris tools_command.php Multiple Parameters Command Injection Attempt (CVE-2024-5196) (web_specific_apps.rules)
  • 2071415 - ET WEB_SPECIFIC_APPS Arris diag_s.php customer_info Parameter Command Injection Attempt (CVE-2024-5195) (web_specific_apps.rules)