Ruleset Update Summary - 2026/08/17 - v11258

Ruleset Updates
1

Summary:

16 new OPEN, 33 new PRO (16 + 17)

Added rules:

Open:

  • 2071537 - ET WEB_SPECIFIC_APPS Citrix NetScaler Unauthenticated Remote Code Execution (CVE-2026-8452) (web_specific_apps.rules)
  • 2071538 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (erilhvs .digital) (malware.rules)
  • 2071539 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (erilhvs .digital) in TLS SNI (malware.rules)
  • 2071540 - ET HUNTING GeoFencing Custom 403 Landing Page (hunting.rules)
  • 2071541 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (gonznlez .surf) (exploit_kit.rules)
  • 2071542 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (rodrigeez .surf) (exploit_kit.rules)
  • 2071543 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (gonznlez .surf) (exploit_kit.rules)
  • 2071544 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (rodrigeez .surf) (exploit_kit.rules)
  • 2071545 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (api-workers .westinsinsurance .com) (malware.rules)
  • 2071546 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (api-workers .westinsinsurance .com) (malware.rules)
  • 2071547 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (netscoute .digital) (malware.rules)
  • 2071548 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (netscoute .digital) in TLS SNI (malware.rules)
  • 2071549 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (skunkxd .live) (malware.rules)
  • 2071550 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (skunkxd .live) in TLS SNI (malware.rules)
  • 2071551 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (slovenecow .live) (malware.rules)
  • 2071552 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (slovenecow .live) in TLS SNI (malware.rules)

Pro:

  • 2868252 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868253 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868254 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868255 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868256 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868257 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868258 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868259 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868260 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868261 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868262 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868263 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868264 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868265 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868266 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868267 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868268 - ETPRO MALWARE MatrixHyper Victim Checkin (Host Profile) (malware.rules)

Disabled and modified rules:

  • 2071468 - ET INFO Ethereum RPC Domain in DNS Lookup (1rpc .io) (info.rules)
  • 2071469 - ET INFO Ethereum RPC Domain in TLS SNI (1rpc .io) (info.rules)
  • 2071472 - ET INFO Ethereum RPC Domain in DNS Lookup (cloudflare-eth .com) (info.rules)
  • 2071473 - ET INFO Ethereum RPC Domain in TLS SNI (cloudflare-eth .com) (info.rules)
  • 2868211 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868215 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868220 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868225 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868227 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)