Ruleset Update Summary - 2026/08/14 - v11257

Ruleset Updates
1

Summary:

19 new OPEN, 32 new PRO (19 + 13)

Added rules:

Open:

  • 2071518 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M11 (exploit_kit.rules)
  • 2071519 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M12 (exploit_kit.rules)
  • 2071520 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M13 (exploit_kit.rules)
  • 2071521 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M14 (exploit_kit.rules)
  • 2071522 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M15 (exploit_kit.rules)
  • 2071523 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M16 (exploit_kit.rules)
  • 2071524 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M17 (exploit_kit.rules)
  • 2071525 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M18 (exploit_kit.rules)
  • 2071526 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M19 (exploit_kit.rules)
  • 2071527 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M20 (exploit_kit.rules)
  • 2071528 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nisyqai .shop) (malware.rules)
  • 2071529 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (nisyqai .shop) in TLS SNI (malware.rules)
  • 2071530 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (unapjjh .shop) (malware.rules)
  • 2071531 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (unapjjh .shop) in TLS SNI (malware.rules)
  • 2071532 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (youngnu .xyz) (malware.rules)
  • 2071533 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (youngnu .xyz) in TLS SNI (malware.rules)
  • 2071534 - ET INFO Free Hosting Domain in DNS Lookup (zya .me) (info.rules)
  • 2071535 - ET INFO Free Hosting Domain in TLS SNI (zya .me) (info.rules)
  • 2071536 - ET WEB_SPECIFIC_APPS Metabase Password Reset SQL Injection (CVE-2026-72898) (web_specific_apps.rules)

Pro:

  • 2868238 - ETPRO EXPLOIT Adobe Commerce & Magento Session Identity Hijack Attempt (CVE-2026-71362) (exploit.rules)
  • 2868240 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile_malware.rules)
  • 2868241 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868242 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868243 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868244 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868245 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868246 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868247 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868248 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868249 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile_malware.rules)
  • 2868250 - ETPRO PHISHING TA2900 Telegram Exfil 2026-08-14 (phishing.rules)
  • 2868251 - ETPRO PHISHING TA2900 Telegram Exfil Response (phishing.rules)

Disabled and modified rules:

  • 2820132 - ETPRO WEB_CLIENT Possible Adobe Reader (CVE-2016-1051) (web_client.rules)