Ruleset Update Summary - 2026/08/12 - v11255

Ruleset Updates
1

Summary:

27 new OPEN, 38 new PRO (27 + 11)

Added rules:

Open:

  • 2071474 - ET EXPLOIT_KIT Generic Web Skimmer Activity (Fetch Javascript Loader) (exploit_kit.rules)
  • 2071475 - ET EXPLOIT_KIT Generic Web Skimmer Domain in DNS Lookup (fg-analytics .biz) (exploit_kit.rules)
  • 2071476 - ET EXPLOIT_KIT Generic Web Skimmer Domain in DNS Lookup (great-fade .sbs) (exploit_kit.rules)
  • 2071477 - ET EXPLOIT_KIT Generic Web Skimmer Domain in DNS Lookup (grant-member .pro) (exploit_kit.rules)
  • 2071478 - ET EXPLOIT_KIT Generic Web Skimmer Domain in DNS Lookup (bacon-rumors .xyz) (exploit_kit.rules)
  • 2071479 - ET EXPLOIT_KIT Generic Web Skimmer Domain in DNS Lookup (fashion-chicken .com) (exploit_kit.rules)
  • 2071480 - ET EXPLOIT_KIT Generic Web Skimmer Domain in TLS SNI (fg-analytics .biz) (exploit_kit.rules)
  • 2071481 - ET EXPLOIT_KIT Generic Web Skimmer Domain in TLS SNI (great-fade .sbs) (exploit_kit.rules)
  • 2071482 - ET EXPLOIT_KIT Generic Web Skimmer Domain in TLS SNI (grant-member .pro) (exploit_kit.rules)
  • 2071483 - ET EXPLOIT_KIT Generic Web Skimmer Domain in TLS SNI (bacon-rumors .xyz) (exploit_kit.rules)
  • 2071484 - ET EXPLOIT_KIT Generic Web Skimmer Domain in TLS SNI (fashion-chicken .com) (exploit_kit.rules)
  • 2071485 - ET WEB_SPECIFIC_APPS Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) M1 (web_specific_apps.rules)
  • 2071486 - ET WEB_SPECIFIC_APPS Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) M2 (web_specific_apps.rules)
  • 2071487 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (futupath .cyou) (malware.rules)
  • 2071488 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (futupath .cyou) in TLS SNI (malware.rules)
  • 2071489 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (smarture .cyou) (malware.rules)
  • 2071490 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (smarture .cyou) in TLS SNI (malware.rules)
  • 2071491 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (olivenarthex .top) (exploit_kit.rules)
  • 2071492 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (pergolamimosa .top) (exploit_kit.rules)
  • 2071493 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (cipherbelvedere .top) (exploit_kit.rules)
  • 2071494 - ET EXPLOIT_KIT ClickFix Domain in TLS SNI (olivenarthex .top) (exploit_kit.rules)
  • 2071495 - ET EXPLOIT_KIT ClickFix Domain in TLS SNI (pergolamimosa .top) (exploit_kit.rules)
  • 2071496 - ET EXPLOIT_KIT ClickFix Domain in TLS SNI (cipherbelvedere .top) (exploit_kit.rules)
  • 2071497 - ET EXPLOIT_KIT ClickFix Activity (Fetch for Javascript Loader) M1 (exploit_kit.rules)
  • 2071498 - ET EXPLOIT_KIT ClickFix Activity (Fetch for Javascript Loader) M2 (exploit_kit.rules)
  • 2071499 - ET EXPLOIT_KIT ClickFix Activity (Fetch for Javascript Loader) M3 (exploit_kit.rules)
  • 2071500 - ET EXPLOIT_KIT ClickFix Activity (Fetch for Javascript Loader) M4 (exploit_kit.rules)

Pro:

  • 2868190 - ETPRO WEB_SPECIFIC_APPS Microsoft SharePoint Unauthenticated Remote Code Execution (CVE-2026-63520) (web_specific_apps.rules)
  • 2868191 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868192 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868193 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868194 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868195 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868196 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868197 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868198 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868199 - ETPRO WEB_SPECIFIC_APPS Microsoft SharePoint Unauthenticated Remote Code Execution (CVE-2026-65665) (web_specific_apps.rules)
  • 2868200 - ETPRO EXPLOIT Adobe ColdFusion Unauthenticated Disclosure of PMT Shared Secret via Multicast Discovery (CVE-2026-71384) (exploit.rules)