Ruleset Update Summary - 2026/08/11 - v11254

Ruleset Updates
1

Summary:

37 new OPEN, 47 new PRO (37 + 10)

Added rules:

Open:

  • 2071437 - ET WEB_SPECIFIC_APPS Rapid7 Velociraptor Authenticated Account Takeover via Identity Spoofing (CVE-2026-18972) (web_specific_apps.rules)
  • 2071438 - ET MALWARE Head Mare CnC Domain in DNS Lookup (penzadogshelter .site) (malware.rules)
  • 2071439 - ET MALWARE Head Mare CnC Domain in DNS Lookup (media-hub .today) (malware.rules)
  • 2071440 - ET MALWARE Head Mare CnC Domain in DNS Lookup (trendy-market .site) (malware.rules)
  • 2071441 - ET MALWARE Head Mare CnC Domain in DNS Lookup (rinomobile .ink) (malware.rules)
  • 2071442 - ET MALWARE Head Mare CnC Domain in DNS Lookup (urbanpixel .store) (malware.rules)
  • 2071443 - ET MALWARE Head Mare CnC Domain in DNS Lookup (bright-deals .site) (malware.rules)
  • 2071444 - ET MALWARE Head Mare CnC Domain in DNS Lookup (cosmetic-deals .store) (malware.rules)
  • 2071445 - ET MALWARE Head Mare CnC Domain in DNS Lookup (nova-stream .site) (malware.rules)
  • 2071446 - ET MALWARE Head Mare CnC Domain in DNS Lookup (flexish .shop) (malware.rules)
  • 2071447 - ET MALWARE Head Mare CnC Domain in DNS Lookup (vks .gossopka .forum) (malware.rules)
  • 2071448 - ET MALWARE Observed Head Mare Domain (penzadogshelter .site in TLS SNI) (malware.rules)
  • 2071449 - ET MALWARE Observed Head Mare Domain (media-hub .today in TLS SNI) (malware.rules)
  • 2071450 - ET MALWARE Observed Head Mare Domain (trendy-market .site in TLS SNI) (malware.rules)
  • 2071451 - ET MALWARE Observed Head Mare Domain (rinomobile .ink in TLS SNI) (malware.rules)
  • 2071452 - ET MALWARE Observed Head Mare Domain (urbanpixel .store in TLS SNI) (malware.rules)
  • 2071453 - ET MALWARE Observed Head Mare Domain (bright-deals .site in TLS SNI) (malware.rules)
  • 2071454 - ET MALWARE Observed Head Mare Domain (cosmetic-deals .store in TLS SNI) (malware.rules)
  • 2071455 - ET MALWARE Observed Head Mare Domain (nova-stream .site in TLS SNI) (malware.rules)
  • 2071456 - ET MALWARE Observed Head Mare Domain (flexish .shop in TLS SNI) (malware.rules)
  • 2071457 - ET MALWARE Observed Head Mare Domain (vks .gossopka .forum in TLS SNI) (malware.rules)
  • 2071458 - ET INFO Ethereum RPC Endpoint Domain in DNS Lookup (ethereum-rpc .publicnode .com) (info.rules)
  • 2071459 - ET INFO Ethereum RPC Endpoint Domain in DNS Lookup (0xrpc .io) (info.rules)
  • 2071460 - ET INFO Ethereum RPC Endpoint Domain in DNS Lookup (eth .llamarpc .com) (info.rules)
  • 2071461 - ET INFO Ethereum RPC Endpoint Domain in DNS Lookup (eth .merkle .io) (info.rules)
  • 2071462 - ET INFO Ethereum RPC Endpoint Domain in DNS Lookup (eth-protect .rpc .blxrbdn .com) (info.rules)
  • 2071463 - ET INFO Observed Ethereum RPC Endpoint Domain (ethereum-rpc .publicnode .com in TLS SNI) (info.rules)
  • 2071464 - ET INFO Observed Ethereum RPC Endpoint Domain (0xrpc .io in TLS SNI) (info.rules)
  • 2071465 - ET INFO Observed Ethereum RPC Endpoint Domain (eth .llamarpc .com in TLS SNI) (info.rules)
  • 2071466 - ET INFO Observed Ethereum RPC Endpoint Domain (eth .merkle .io in TLS SNI) (info.rules)
  • 2071467 - ET INFO Observed Ethereum RPC Endpoint Domain (eth-protect .rpc .blxrbdn .com in TLS SNI) (info.rules)
  • 2071468 - ET INFO Ethereum RPC Domain in DNS Lookup (1rpc .io) (info.rules)
  • 2071469 - ET INFO Ethereum RPC Domain in TLS SNI (1rpc .io) (info.rules)
  • 2071470 - ET INFO Ethereum RPC Domain in DNS Lookup (api .securerpc .com) (info.rules)
  • 2071471 - ET INFO Ethereum RPC Domain in TLS SNI (api .securerpc .com) (info.rules)
  • 2071472 - ET INFO Ethereum RPC Domain in DNS Lookup (cloudflare-eth .com) (info.rules)
  • 2071473 - ET INFO Ethereum RPC Domain in TLS SNI (cloudflare-eth .com) (info.rules)

Pro:

  • 2868177 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868178 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868179 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868180 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868181 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868182 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868183 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868184 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868188 - ETPRO EXPLOIT Microsoft Windows Deployment Services TFTP Server Remote Code Execution (CVE-2026-62893) (exploit.rules)
  • 2868189 - ETPRO EXPLOIT Microsoft Windows DHCP Server Remote Code Execution (CVE-2026-62823) (exploit.rules)