Ruleset Update Summary - 2026/08/20 - v11261

Ruleset Updates
1

Summary:

46 new OPEN, 48 new PRO (46 + 2)

Added rules:

Open:

  • 2071637 - ET INFO Tailscale Control Pane in DNS Query (info.rules)
  • 2071638 - ET INFO Tailscle DERP Relay Server in DNS Query (info.rules)
  • 2071639 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guirreiro .lol) (exploit_kit.rules)
  • 2071640 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (montoiro .lol) (exploit_kit.rules)
  • 2071641 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (guirreiro .lol) (exploit_kit.rules)
  • 2071642 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (montoiro .lol) (exploit_kit.rules)
  • 2071643 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (post-ld .pgcountyliving .com) (malware.rules)
  • 2071644 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (post-ld .pgcountyliving .com) (malware.rules)
  • 2071645 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (FlouriszhZozne .top) (malware.rules)
  • 2071646 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (FlouriszhZozne .top) in TLS SNI (malware.rules)
  • 2071647 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (activheharmony .cyou) (malware.rules)
  • 2071648 - ET INFO Tailscale Control Pane in TLS SNI (info.rules)
  • 2071649 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (activheharmony .cyou) in TLS SNI (malware.rules)
  • 2071650 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (craftyciorner .hair) (malware.rules)
  • 2071651 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (craftyciorner .hair) in TLS SNI (malware.rules)
  • 2071652 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (selfdiscozvery .tech) (malware.rules)
  • 2071653 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (selfdiscozvery .tech) in TLS SNI (malware.rules)
  • 2071654 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soulfujltraveler .hair) (malware.rules)
  • 2071655 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (soulfujltraveler .hair) in TLS SNI (malware.rules)
  • 2071656 - ET INFO Tailscale DERP Relay Server in TLS SNI (info.rules)
  • 2071657 - ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (hivinest .online) (exploit_kit.rules)
  • 2071658 - ET EXPLOIT_KIT Observed DNS Query to ClickFix Domain (veruisuealx .xyz) (exploit_kit.rules)
  • 2071659 - ET EXPLOIT_KIT Observed ClickFix Domain (hivinest .online in TLS SNI) (exploit_kit.rules)
  • 2071660 - ET EXPLOIT_KIT Observed ClickFix Domain (veruisuealx .xyz in TLS SNI) (exploit_kit.rules)
  • 2071661 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M31 (exploit_kit.rules)
  • 2071662 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M32 (exploit_kit.rules)
  • 2071663 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M33 (exploit_kit.rules)
  • 2071664 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M34 (exploit_kit.rules)
  • 2071665 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M35 (exploit_kit.rules)
  • 2071666 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M36 (exploit_kit.rules)
  • 2071667 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M37 (exploit_kit.rules)
  • 2071668 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M38 (exploit_kit.rules)
  • 2071669 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M39 (exploit_kit.rules)
  • 2071670 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M40 (exploit_kit.rules)
  • 2071671 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M41 (exploit_kit.rules)
  • 2071672 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M42 (exploit_kit.rules)
  • 2071673 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M43 (exploit_kit.rules)
  • 2071674 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M44 (exploit_kit.rules)
  • 2071675 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M45 (exploit_kit.rules)
  • 2071676 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M46 (exploit_kit.rules)
  • 2071677 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M47 (exploit_kit.rules)
  • 2071678 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M48 (exploit_kit.rules)
  • 2071679 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M49 (exploit_kit.rules)
  • 2071680 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M50 (exploit_kit.rules)
  • 2071681 - ET WEB_SPECIFIC_APPS IceWarp14 X-File-Operation Command Injection Remote Code Execution (CVE-2025-14500) (web_specific_apps.rules)
  • 2071682 - ET MALWARE EtherHiding Exfil M3 (malware.rules)

Pro:

  • 2868326 - ETPRO ATTACK_RESPONSE EtherHiding Payload Delivery Script Observed Inbound (attack_response.rules)
  • 2868327 - ETPRO MALWARE EtherHiding CnC Update Check (malware.rules)

Disabled and modified rules:

  • 2807496 - ETPRO MALWARE Trojan/Win32.Zbot Covert Channel port 53 - SET (malware.rules)
  • 2808226 - ETPRO MALWARE Trojan/Win32.Zbot Covert Channel port 53 (malware.rules)