Ruleset Update Summary - 2026/08/26 - v11267

Ruleset Updates
1

Summary:

15 new OPEN, 34 new PRO (15 + 19)

Added rules:

Open:

  • 2071805 - ET WEB_SPECIFIC_APPS Asus apply.cgi ca_manage_file_name_ca Parameter Directory Traversal Attempt (web_specific_apps.rules)
  • 2071806 - ET WEB_SPECIFIC_APPS Cisco IperfClientCmd Multiple Parameters Command Injection Attempt (web_specific_apps.rules)
  • 2071807 - ET WEB_SPECIFIC_APPS Cisco Start_EPI Multiple Parameters Command Injection Attempt (web_specific_apps.rules)
  • 2071808 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cemeteryun .cyou) (malware.rules)
  • 2071809 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cemeteryun .cyou) in TLS SNI (malware.rules)
  • 2071810 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cosmic-canvas .shop) (malware.rules)
  • 2071811 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cosmic-canvas .shop) in TLS SNI (malware.rules)
  • 2071812 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (parachutedisky .cyou) (malware.rules)
  • 2071813 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (parachutedisky .cyou) in TLS SNI (malware.rules)
  • 2071814 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (titlewoundyb .cyou) (malware.rules)
  • 2071815 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (titlewoundyb .cyou) in TLS SNI (malware.rules)
  • 2071816 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (client .assuredpestcontrolutah .com) (malware.rules)
  • 2071817 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (prime .destroythebrainonline .com) (malware.rules)
  • 2071818 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (client .assuredpestcontrolutah .com) (malware.rules)
  • 2071819 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (prime .destroythebrainonline .com) (malware.rules)

Pro:

  • 2868369 - ETPRO MALWARE Observed DNS Query to MakinoLoader Domain (malware.rules)
  • 2868370 - ETPRO MALWARE Observed MakinoLoader Domain in TLS SNI (malware.rules)
  • 2868371 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868372 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868373 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868374 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868375 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868376 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868377 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868378 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868379 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868380 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868381 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868382 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868383 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868384 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868385 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868386 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868387 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)

Disabled and modified rules:

  • 2868365 - ETPRO MALWARE MakinoLoader CnC Checkin Response (malware.rules)