Ruleset Update Summary - 2026/08/21 - v11262

Ruleset Updates
1

Summary:

41 new OPEN, 50 new PRO (41 + 9)

Added rules:

Open:

  • 2071683 - ET WEB_SPECIFIC_APPS Apache Tika XML External Entity Injection (CVE-2025-54988) (web_specific_apps.rules)
  • 2071684 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (pa-api .salondeguitaredemontreal .com) (malware.rules)
  • 2071685 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (pa-api .salondeguitaredemontreal .com) (malware.rules)
  • 2071686 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M52 (exploit_kit.rules)
  • 2071687 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M53 (exploit_kit.rules)
  • 2071688 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M54 (exploit_kit.rules)
  • 2071689 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chiefdramatico .click) (malware.rules)
  • 2071690 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M55 (exploit_kit.rules)
  • 2071691 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chiefdramatico .click) in TLS SNI (malware.rules)
  • 2071692 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (churhemarke .online) (malware.rules)
  • 2071693 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M56 (exploit_kit.rules)
  • 2071694 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (churhemarke .online) in TLS SNI (malware.rules)
  • 2071695 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M57 (exploit_kit.rules)
  • 2071696 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (confidespill .top) (malware.rules)
  • 2071697 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (confidespill .top) in TLS SNI (malware.rules)
  • 2071698 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (declarationlastyj .shop) (malware.rules)
  • 2071699 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (declarationlastyj .shop) in TLS SNI (malware.rules)
  • 2071700 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (giddyeldirel .help) (malware.rules)
  • 2071701 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (giddyeldirel .help) in TLS SNI (malware.rules)
  • 2071702 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kitestarepatt .click) (malware.rules)
  • 2071703 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (kitestarepatt .click) in TLS SNI (malware.rules)
  • 2071704 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manuejcruwhj .cyou) (malware.rules)
  • 2071705 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (manuejcruwhj .cyou) in TLS SNI (malware.rules)
  • 2071706 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (monstrousdemeniw .shop) (malware.rules)
  • 2071707 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (monstrousdemeniw .shop) in TLS SNI (malware.rules)
  • 2071708 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M58 (exploit_kit.rules)
  • 2071709 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M59 (exploit_kit.rules)
  • 2071710 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M60 (exploit_kit.rules)
  • 2071711 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M61 (exploit_kit.rules)
  • 2071712 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M62 (exploit_kit.rules)
  • 2071713 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M63 (exploit_kit.rules)
  • 2071714 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M64 (exploit_kit.rules)
  • 2071715 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M65 (exploit_kit.rules)
  • 2071716 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M66 (exploit_kit.rules)
  • 2071717 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M67 (exploit_kit.rules)
  • 2071718 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M68 (exploit_kit.rules)
  • 2071719 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M69 (exploit_kit.rules)
  • 2071720 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M70 (exploit_kit.rules)
  • 2071721 - ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M51 (exploit_kit.rules)
  • 2071722 - ET MALWARE go-titan Registration Attempt (malware.rules)
  • 2071723 - ET WEB_SPECIFIC_APPS OpenCTI Hardcoded admin UUID Authentication Bypass (CVE-2026-27960) (web_specific_apps.rules)

Pro:

  • 2868328 - ETPRO WEB_SPECIFIC_APPS Thymeleaf Authentication Bypass (CVE-2026-40478) (web_specific_apps.rules)
  • 2868329 - ETPRO WEB_SPECIFIC_APPS GitHub Enterprise Server Remote Code Execution (CVE-2026-3854) (web_specific_apps.rules)
  • 2868331 - ETPRO MALWARE julietaderomeu Config Request M1 (malware.rules)
  • 2868332 - ETPRO ATTACK_RESPONSE julietaderomeu Config Inbound M1 (attack_response.rules)
  • 2868333 - ETPRO MALWARE julietaderomeu Payload Request (malware.rules)
  • 2868334 - ETPRO ATTACK_RESPONSE julietaderomeu Payload Inbound (attack_response.rules)
  • 2868335 - ETPRO MALWARE julietaderomeu Config Request M2 (malware.rules)
  • 2868336 - ETPRO ATTACK_RESPONSE julietaderomeu Config Inbound M2 (attack_response.rules)
  • 2868337 - ETPRO MALWARE julietaderomeu Victim Registration (malware.rules)

Modified inactive rules:

  • 2865322 - ETPRO PHISHING Observed DNS Query to TA393 Domain (phishing.rules)
  • 2865323 - ETPRO PHISHING Observed DNS Query to TA393 Domain (phishing.rules)
  • 2865324 - ETPRO PHISHING Observed TA393 Domain in TLS SNI (phishing.rules)
  • 2865325 - ETPRO PHISHING Observed TA393 Domain in TLS SNI (phishing.rules)