Ruleset Update Summary - 2026/08/25 - v11266

Ruleset Updates
1

Summary:

22 new OPEN, 35 new PRO (22 + 13)

Added rules:

Open:

  • 2071782 - ET MALWARE GET Request to Minecraft Java Edition Port with Custom X-Header (malware.rules)
  • 2071784 - ET MALWARE DeviceManager CnC DNS Communication - Status Update (malware.rules)
  • 2071785 - ET MALWARE DeviceManager CnC HTTP Requests - Checkin (malware.rules)
  • 2071786 - ET MALWARE DeviceManager CnC HTTP Requests - Task Polling (malware.rules)
  • 2071787 - ET MALWARE DeviceManager CnC HTTP Requests - Result Submission (malware.rules)
  • 2071788 - ET EXPLOIT Microsoft Copilot One-Click Auto Execution Prompt (CVE-2026-24301) (exploit.rules)
  • 2071789 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (asylumejkr .icu) (malware.rules)
  • 2071790 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (asylumejkr .icu) in TLS SNI (malware.rules)
  • 2071791 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (consumeroo .sbs) (malware.rules)
  • 2071792 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (consumeroo .sbs) in TLS SNI (malware.rules)
  • 2071793 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drownequip .cyou) (malware.rules)
  • 2071794 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drownequip .cyou) in TLS SNI (malware.rules)
  • 2071795 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (earn-smash .cyou) (malware.rules)
  • 2071796 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (earn-smash .cyou) in TLS SNI (malware.rules)
  • 2071797 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (officenba .cyou) (malware.rules)
  • 2071798 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (officenba .cyou) in TLS SNI (malware.rules)
  • 2071799 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pianoswimen .shop) (malware.rules)
  • 2071800 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pianoswimen .shop) in TLS SNI (malware.rules)
  • 2071801 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rewardywenb .cyou) (malware.rules)
  • 2071802 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rewardywenb .cyou) in TLS SNI (malware.rules)
  • 2071803 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (snail-r1ced .cyou) (malware.rules)
  • 2071804 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (snail-r1ced .cyou) in TLS SNI (malware.rules)

Pro:

  • 2868356 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868357 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868358 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868359 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868360 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868361 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868362 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868363 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868364 - ETPRO MALWARE MakinoLoader CnC Checkin (malware.rules)
  • 2868365 - ETPRO MALWARE MakinoLoader CnC Checkin Response (malware.rules)
  • 2868366 - ETPRO MALWARE MakinoLoader Victim Send Sysinfo (malware.rules)
  • 2868367 - ETPRO MALWARE MakinoLoader Victim HeartBeat (malware.rules)
  • 2868368 - ETPRO MALWARE MakinoLoader Victim Send AV Details (malware.rules)

Removed rules:

  • 2071782 - ET HUNTING GET Request to Minecraft Java Edition Port with Custom X-Header (hunting.rules)