Ruleset Update Summary - 2026/08/24 - v11265

Ruleset Updates
1

Summary:

60 new OPEN, 78 new PRO (60 + 18)

Thanks @500mk500, @skocherhan

Added rules:

Open:

  • 2071724 - ET MALWARE Lumma Stealer Domain in DNS Lookup (abangan .cyou) (malware.rules)
  • 2071725 - ET MALWARE Lumma Stealer Domain in DNS Lookup (beechea .cyou) (malware.rules)
  • 2071726 - ET MALWARE Lumma Stealer Domain in DNS Lookup (choppyi .cyou) (malware.rules)
  • 2071727 - ET MALWARE Lumma Stealer Domain in DNS Lookup (deckerh .cyou) (malware.rules)
  • 2071728 - ET MALWARE Lumma Stealer Domain in DNS Lookup (desexur .cyou) (malware.rules)
  • 2071729 - ET MALWARE Lumma Stealer Domain in DNS Lookup (encephw .cyou) (malware.rules)
  • 2071730 - ET MALWARE Lumma Stealer Domain in DNS Lookup (genuscr .cyou) (malware.rules)
  • 2071731 - ET MALWARE Lumma Stealer Domain in DNS Lookup (matchny .cyou) (malware.rules)
  • 2071732 - ET MALWARE Lumma Stealer Domain in DNS Lookup (deckerh .cyou) (malware.rules)
  • 2071733 - ET MALWARE Lumma Stealer Domain in DNS Lookup (matchny .cyou) (malware.rules)
  • 2071734 - ET MALWARE Lumma Stealer Domain in TLS SNI (abangan .cyou) (malware.rules)
  • 2071735 - ET MALWARE Lumma Stealer Domain in TLS SNI (beechea .cyou) (malware.rules)
  • 2071736 - ET MALWARE Lumma Stealer Domain in TLS SNI (choppyi .cyou) (malware.rules)
  • 2071737 - ET MALWARE Lumma Stealer Domain in TLS SNI (deckerh .cyou) (malware.rules)
  • 2071738 - ET MALWARE Lumma Stealer Domain in TLS SNI (desexur .cyou) (malware.rules)
  • 2071739 - ET MALWARE Lumma Stealer Domain in TLS SNI (encephw .cyou) (malware.rules)
  • 2071740 - ET MALWARE Lumma Stealer Domain in TLS SNI (genuscr .cyou) (malware.rules)
  • 2071741 - ET MALWARE Lumma Stealer Domain in TLS SNI (matchny .cyou) (malware.rules)
  • 2071742 - ET MALWARE Lumma Stealer Domain in TLS SNI (deckerh .cyou) (malware.rules)
  • 2071743 - ET MALWARE Lumma Stealer Domain in TLS SNI (matchny .cyou) (malware.rules)
  • 2071744 - ET INFO Observed WindowsPowerShell/5.1 User Agent Usage (info.rules)
  • 2071745 - ET INFO Observed PowerShell/7 User Agent Usage (info.rules)
  • 2071746 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (battlecaredh .click) (malware.rules)
  • 2071747 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (battlecaredh .click) in TLS SNI (malware.rules)
  • 2071748 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (froggraduategravi .fun) (malware.rules)
  • 2071749 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (froggraduategravi .fun) in TLS SNI (malware.rules)
  • 2071750 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (holidayeyeus .cyou) (malware.rules)
  • 2071751 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (holidayeyeus .cyou) in TLS SNI (malware.rules)
  • 2071752 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (optinewlip .shop) (malware.rules)
  • 2071753 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (optinewlip .shop) in TLS SNI (malware.rules)
  • 2071754 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reflectsurmise .cfd) (malware.rules)
  • 2071755 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reflectsurmise .cfd) in TLS SNI (malware.rules)
  • 2071756 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chalkdurggybetjuow .site) (malware.rules)
  • 2071757 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chalkdurggybetjuow .site) in TLS SNI (malware.rules)
  • 2071758 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lonylexpedn .my) (malware.rules)
  • 2071759 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lonylexpedn .my) in TLS SNI (malware.rules)
  • 2071760 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mintysoary .help) (malware.rules)
  • 2071761 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mintysoary .help) in TLS SNI (malware.rules)
  • 2071762 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reeferpict .cfd) (malware.rules)
  • 2071763 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reeferpict .cfd) in TLS SNI (malware.rules)
  • 2071764 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (samledwwekspzxp .shop) (malware.rules)
  • 2071765 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (samledwwekspzxp .shop) in TLS SNI (malware.rules)
  • 2071766 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (simplicitynegotiatiw .shop) (malware.rules)
  • 2071767 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (simplicitynegotiatiw .shop) in TLS SNI (malware.rules)
  • 2071768 - ET INFO Tailscale Control Pane Websocket Upgrade Request (info.rules)
  • 2071769 - ET INFO Tailscale DERP Websocket Upgrade Request (info.rules)
  • 2071770 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (bechteltr .lol) (exploit_kit.rules)
  • 2071771 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (bechteltr .lol) (exploit_kit.rules)
  • 2071772 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cf-api .indianadforum .com) (malware.rules)
  • 2071773 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cf-api .indianadforum .com) (malware.rules)
  • 2071774 - ET WEB_SPECIFIC_APPS Microsoft SharePoint Server Unauthenticated Remote Code Execution (CVE-2026-58644) (web_specific_apps.rules)
  • 2071775 - ET WEB_SPECIFIC_APPS Flowise Unauthenticated OAuth Configuration Disclosure (CVE-2026-56270) (web_specific_apps.rules)
  • 2071776 - ET WEB_SPECIFIC_APPS Gitea Unauthenticated Arbitrary File Read (CVE-2026-59774) (web_specific_apps.rules)
  • 2071777 - ET WEB_SPECIFIC_APPS Kestra Unauthenticated Remote Code Execution (CVE-2026-53576) (web_specific_apps.rules)
  • 2071778 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grzpoint .cyou) (malware.rules)
  • 2071779 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grzpoint .cyou) in TLS SNI (malware.rules)
  • 2071780 - ET WEB_SPECIFIC_APPS Gitlab GraphQL Unauthenticated Code Injection (CVE-2026-19478) (web_specific_apps.rules)
  • 2071781 - ET WEB_SPECIFIC_APPS Kubernetes Secret Extraction via ArgoCD ServerSideDiff (CVE-2026-42880) (web_specific_apps.rules)
  • 2071782 - ET HUNTING GET Request to Minecraft Java Edition Port with Custom X-Header (hunting.rules)
  • 2071783 - ET HUNTING GET Request to Minecraft Java Edition Port (hunting.rules)

Pro:

  • 2868338 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868339 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868340 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868341 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868342 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868343 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868344 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868345 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868346 - ETPRO PHISHING Houyi Phishing Kit Browser Fingerprint Response (phishing.rules)
  • 2868347 - ETPRO PHISHING Houyi Phishing Kit Landing Page Delivery Attempt (phishing.rules)
  • 2868348 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868349 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868350 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868351 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868352 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868353 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868354 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868355 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

Disabled and modified rules:

  • 2868324 - ETPRO MALWARE ClickFix Campaign Tracker CnC Activity (malware.rules)