Ruleset Update Summary - 2026/08/10 - v11253

Ruleset Updates
1

Summary:

10 new OPEN, 26 new PRO (10 + 16)

Added rules:

Open:

  • 2071427 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (salveupp .run) (malware.rules)
  • 2071428 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (salveupp .run) in TLS SNI (malware.rules)
  • 2071429 - ET INFO DYNAMIC_DNS Query to a *.robertschulze .name domain (info.rules)
  • 2071430 - ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .name domain (info.rules)
  • 2071431 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (valuidge .cyou) (malware.rules)
  • 2071432 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (valuidge .cyou) in TLS SNI (malware.rules)
  • 2071433 - ET WEB_SPECIFIC_APPS JetBrains TeamCity On-Premise Unauthenticated Remote Code Execution (CVE-2026-63077) (web_specific_apps.rules)
  • 2071434 - ET WEB_SPECIFIC_APPS Joomla JCE Unauthenticated Remote Code Execution (CVE-2026-48907) (web_specific_apps.rules)
  • 2071435 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (ui-portal .mekebibsolomonlaw .com) (malware.rules)
  • 2071436 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (ui-portal .mekebibsolomonlaw .com) (malware.rules)

Pro:

  • 2868161 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868162 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868163 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868164 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868165 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868166 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868167 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868168 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868169 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868170 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868171 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868172 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868173 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868174 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868175 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868176 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)