Ruleset Update Summary - 2026/08/19 - v11260

Ruleset Updates
1

Summary:

54 new OPEN, 84 new PRO (54 + 30)

Added rules:

Open:

  • 2071583 - ET CURRENT_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCFleet/1.0) (current_events.rules)
  • 2071584 - ET CURRENT_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCProbe/1.0) (current_events.rules)
  • 2071585 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (randenbrink .lol) (exploit_kit.rules)
  • 2071586 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (rutrerford .lol) (exploit_kit.rules)
  • 2071587 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (stevsns .lol) (exploit_kit.rules)
  • 2071588 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (vanloon .lol) (exploit_kit.rules)
  • 2071589 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (randenbrink .lol) (exploit_kit.rules)
  • 2071590 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (rutrerford .lol) (exploit_kit.rules)
  • 2071591 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (stevsns .lol) (exploit_kit.rules)
  • 2071592 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (vanloon .lol) (exploit_kit.rules)
  • 2071593 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cdnmedia .trailsyamahamotor .com) (malware.rules)
  • 2071594 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (missed-upd .happyhatterreviews .com) (malware.rules)
  • 2071595 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cdnmedia .trailsyamahamotor .com) (malware.rules)
  • 2071596 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (missed-upd .happyhatterreviews .com) (malware.rules)
  • 2071597 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chemistrycworner .today) (malware.rules)
  • 2071598 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chemistrycworner .today) in TLS SNI (malware.rules)
  • 2071599 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (datadynnamics .today) (malware.rules)
  • 2071600 - ET WEB_SPECIFIC_APPS Microsoft Windows Admin Center Elevation of Privilege (CVE-2026-26119) (web_specific_apps.rules)
  • 2071601 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (datadynnamics .today) in TLS SNI (malware.rules)
  • 2071602 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (elephancouped .fun) (malware.rules)
  • 2071603 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (elephancouped .fun) in TLS SNI (malware.rules)
  • 2071604 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mildpacewp .today) (malware.rules)
  • 2071605 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mildpacewp .today) in TLS SNI (malware.rules)
  • 2071606 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (penetratebatt .pw) (malware.rules)
  • 2071607 - ET WEB_SPECIFIC_APPS Progress WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass (CVE-2024-6671) (web_specific_apps.rules)
  • 2071608 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (penetratebatt .pw) in TLS SNI (malware.rules)
  • 2071609 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (unigtyincommunity .tech) (malware.rules)
  • 2071610 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (unigtyincommunity .tech) in TLS SNI (malware.rules)
  • 2071611 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zenrichyourlife .tech) (malware.rules)
  • 2071612 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zenrichyourlife .tech) in TLS SNI (malware.rules)
  • 2071613 - ET MALWARE Observed DNS Query to ClickFix Domain (designerlink .su) (malware.rules)
  • 2071614 - ET MALWARE Observed DNS Query to ClickFix Domain (akb .cat) (malware.rules)
  • 2071615 - ET MALWARE Observed DNS Query to ClickFix Domain (designlinks .live) (malware.rules)
  • 2071616 - ET MALWARE Observed DNS Query to ClickFix Domain (zrorolite .com) (malware.rules)
  • 2071617 - ET MALWARE Observed ClickFix Domain (designerlink .su in TLS SNI) (malware.rules)
  • 2071618 - ET MALWARE Observed ClickFix Domain (akb .cat in TLS SNI) (malware.rules)
  • 2071619 - ET MALWARE Observed ClickFix Domain (designlinks .live in TLS SNI) (malware.rules)
  • 2071620 - ET MALWARE Observed ClickFix Domain (zrorolite .com in TLS SNI) (malware.rules)
  • 2071621 - ET INFO Observed Telegram Domain in DNS Lookup (t .you) (info.rules)
  • 2071622 - ET INFO Observed Telegram Domain in TLS SNI (t .you) (info.rules)
  • 2071623 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .dog) (info.rules)
  • 2071624 - ET INFO Observed Telegram Domain in TLS SNI (telegram .dog) (info.rules)
  • 2071625 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .gift) (info.rules)
  • 2071626 - ET INFO Observed Telegram Domain in TLS SNI (telegram .gift) (info.rules)
  • 2071627 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .org) (info.rules)
  • 2071628 - ET INFO Observed Telegram Domain in TLS SNI (telegram .org) (info.rules)
  • 2071629 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .space) (info.rules)
  • 2071630 - ET INFO Observed Telegram Domain in TLS SNI (telegram .space) (info.rules)
  • 2071631 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .supply) (info.rules)
  • 2071632 - ET INFO Observed Telegram Domain in TLS SNI (telegram .supply) (info.rules)
  • 2071633 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules)
  • 2071634 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules)
  • 2071635 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules)
  • 2071636 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules)

Pro:

  • 2804662 - ETPRO RETIRED Adobe Flash Player file with Matrix3D.copyRawDataFrom() function (retired.rules)
  • 2811346 - ETPRO RETIRED Internet Explorer Memory Corruption Vulnerability (CVE-2015-1731) (retired.rules)
  • 2868298 - ETPRO MALWARE Vidar Stealer CnC Checkin Response (malware.rules)
  • 2868299 - ETPRO MALWARE Vidar Stealer CnC Activity via Telegram (malware.rules)
  • 2868300 - ETPRO MALWARE Vidar Stealer CnC Activity via Telegram (malware.rules)
  • 2868301 - ETPRO MALWARE Observed Vidar Stealer User-Agent (malware.rules)
  • 2868302 - ETPRO ACTIVEX PTC Windchill JSP Webshell Inbound Requests (activex.rules)
  • 2868303 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868304 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868305 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868306 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868307 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868308 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868309 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868310 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868311 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868312 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868313 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868314 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868315 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868316 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868317 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868318 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868319 - ETPRO EXPLOIT Netgate pfSense Authenticated RCE via Unsafe Deserialization (CVE-2025-69690) (exploit.rules)
  • 2868320 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868321 - ETPRO EXPLOIT Netgate pfSense Authenticated RCE via XMLRPC exec_php (CVE-2025-69691) (exploit.rules)
  • 2868322 - ETPRO EXPLOIT_KIT ClickFix Javascript Loader Observed (exploit_kit.rules)
  • 2868323 - ETPRO EXPLOIT_KIT ClickFix Javascript Loader Observed (exploit_kit.rules)
  • 2868324 - ETPRO MALWARE ClickFix Campaign Tracker CnC Activity (malware.rules)
  • 2868325 - ETPRO MALWARE ClickFix Campaign Tracker CnC Response (malware.rules)

Disabled and modified rules:

  • 2850244 - ETPRO WEB_CLIENT V8 Engine Type Confusion Exploit Inbound - POC Based (CVE-2021-21224) (web_client.rules)

Removed rules:

  • 2804662 - ETPRO WEB_CLIENT Adobe Flash Player file with Matrix3D.copyRawDataFrom() function (web_client.rules)
  • 2811346 - ETPRO WEB_CLIENT Internet Explorer Memory Corruption Vulnerability (CVE-2015-1731) (web_client.rules)