Ruleset Update Summary - 2026/08/18 - v11259

Ruleset Updates
1

Summary:

30 new OPEN, 59 new PRO (30 + 29)

Added rules:

Open:

  • 2071553 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M21 (exploit_kit.rules)
  • 2071554 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M22 (exploit_kit.rules)
  • 2071555 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M23 (exploit_kit.rules)
  • 2071556 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M24 (exploit_kit.rules)
  • 2071557 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M25 (exploit_kit.rules)
  • 2071558 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M26 (exploit_kit.rules)
  • 2071559 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M27 (exploit_kit.rules)
  • 2071560 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M28 (exploit_kit.rules)
  • 2071561 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M29 (exploit_kit.rules)
  • 2071562 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M30 (exploit_kit.rules)
  • 2071563 - ET EXPLOIT Kingsoft WPS Office ksoqing URI Handler Remote Code Execution Attempt (CVE-2024-7262) (exploit.rules)
  • 2071564 - ET WEB_SPECIFIC_APPS Draytek DownloadFileServlet show_file_name Parameter Directory Traversal Attempt (CVE-2021-20123) (web_specific_apps.rules)
  • 2071565 - ET WEB_SPECIFIC_APPS Draytek WebServlet filename Parameter Directory Traversal Attempt (CVE-2021-20124) (web_specific_apps.rules)
  • 2071566 - ET WEB_SPECIFIC_APPS PTZOptics post_network_other_conf ntp_addr Parameter Command Injection Attempt (CVE-2024-8957) (web_specific_apps.rules)
  • 2071567 - ET INFO Observed Telegram Domain in DNS Lookup (comments .app) (info.rules)
  • 2071568 - ET INFO Observed Telegram Domain in TLS SNI (comments .app) (info.rules)
  • 2071569 - ET INFO Observed Telegram Domain in DNS Lookup (t .me) (info.rules)
  • 2071570 - ET INFO Observed Telegram Domain in TLS SNI (t .me) (info.rules)
  • 2071571 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .me) (info.rules)
  • 2071572 - ET INFO Observed Telegram Domain in TLS SNI (telegram .me) (info.rules)
  • 2071573 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (jzourneyy .shop) (malware.rules)
  • 2071574 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (jzourneyy .shop) in TLS SNI (malware.rules)
  • 2071575 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lunarise .bet) (malware.rules)
  • 2071576 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lunarise .bet) in TLS SNI (malware.rules)
  • 2071577 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moonskyo .run) (malware.rules)
  • 2071578 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (moonskyo .run) in TLS SNI (malware.rules)
  • 2071579 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sensacoukwekch .com) (malware.rules)
  • 2071580 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sensacoukwekch .com) in TLS SNI (malware.rules)
  • 2071581 - ET INFO Telegram Auth Cookie (stel_ssid) (info.rules)
  • 2071582 - ET INFO Telegram Auth Cookie (stel_token) (info.rules)

Pro:

  • 2868269 - ETPRO MALWARE UNK_TransparentTribe CnC Checkin Activity (malware.rules)
  • 2868270 - ETPRO MALWARE UNK_TransparentTribe CnC Heartbeat Outbound M1 (malware.rules)
  • 2868271 - ETPRO MALWARE UNK_TransparentTribe CnC Heartbeat Outbound M2 (malware.rules)
  • 2868272 - ETPRO WEB_SPECIFIC_APPS Apache Tomcat Unauthenticated JMX Proxy Access (web_specific_apps.rules)
  • 2868273 - ETPRO WEB_SPECIFIC_APPS Veeam Backup Enterprise Authentication Bypass (CVE-2024-29849) (web_specific_apps.rules)
  • 2868274 - ETPRO INFO Veeam Backup Enterprise Authentication Valid RequestSecurityTokenResponse Response (info.rules)
  • 2868275 - ETPRO INFO Veeam Backup Enterprise Authentication Success (info.rules)
  • 2868276 - ETPRO WEB_SPECIFIC_APPS SolarWinds Serv-U Unauthenticated Denial of Service (CVE-2026-28318) (web_specific_apps.rules)
  • 2868277 - ETPRO WEB_SPECIFIC_APPS Splunk Enterprise Unauthenticated Arbitrary File Upload (CVE-2023-40598) (web_specific_apps.rules)
  • 2868278 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868279 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868280 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868281 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868282 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868283 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868284 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868285 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868286 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868287 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868288 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868289 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868290 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868291 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868292 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868293 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868294 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868295 - ETPRO MALWARE Vidar Stealer Related Telegram Profile (malware.rules)
  • 2868296 - ETPRO MALWARE Vidar Stealer CnC Domain in DNS Lookup (malware.rules)
  • 2868297 - ETPRO MALWARE Vidar Stealer CnC Domain in TLS SNI (malware.rules)