Ruleset Update Summary - 2026/08/13 - v11256

Ruleset Updates
1

Summary:

17 new OPEN, 54 new PRO (17 + 37)

Added rules:

Open:

  • 2071501 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M1 (exploit_kit.rules)
  • 2071502 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M2 (exploit_kit.rules)
  • 2071503 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M3 (exploit_kit.rules)
  • 2071504 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M4 (exploit_kit.rules)
  • 2071505 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M5 (exploit_kit.rules)
  • 2071506 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M6 (exploit_kit.rules)
  • 2071507 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M7 (exploit_kit.rules)
  • 2071508 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M8 (exploit_kit.rules)
  • 2071509 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M9 (exploit_kit.rules)
  • 2071510 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M10 (exploit_kit.rules)
  • 2071511 - ET EXPLOIT HP Poly VVX 450 VoIP Unauthenticated Buffer Overflow (CVE-2026-0826) (exploit.rules)
  • 2071512 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inatehub .cyou) (malware.rules)
  • 2071513 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (inatehub .cyou) in TLS SNI (malware.rules)
  • 2071514 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nucleji .my) (malware.rules)
  • 2071515 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (nucleji .my) in TLS SNI (malware.rules)
  • 2071516 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (uniedpureevenywjk .shop) (malware.rules)
  • 2071517 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (uniedpureevenywjk .shop) in TLS SNI (malware.rules)

Pro:

  • 2868201 - ETPRO EXPLOIT Oracle WebLogic Server Authentication Bypass (CVE-2024-21182) (exploit.rules)
  • 2868202 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868203 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868204 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868205 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868206 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868207 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868208 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868209 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868210 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868211 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868212 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868213 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868214 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868215 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868216 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868217 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868218 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868219 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868220 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868221 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868222 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868223 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868224 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868225 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868226 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868227 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868228 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868229 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868230 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868231 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868232 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868233 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868234 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868235 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868236 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2868237 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)