Ruleset Update Summary - 2026/08/27 - v11268

Ruleset Updates
1

Summary:

10 new OPEN, 10 new PRO (10 + 0)

Added rules:

Open:

  • 2071820 - ET EXPLOIT Apache Log4j2 Issue #4255 FilteredObjectInputStream Allowlist Bypass via java.rmi.MarshalledObject (exploit.rules)
  • 2071821 - ET HUNTING HTTP Redirect to Dropbox Hosted PDF (hunting.rules)
  • 2071822 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (expce .directoryindustry .com) (malware.rules)
  • 2071823 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (expce .directoryindustry .com) (malware.rules)
  • 2071824 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (barrychorus .store) (malware.rules)
  • 2071825 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (barrychorus .store) in TLS SNI (malware.rules)
  • 2071826 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leasebu .bet) (malware.rules)
  • 2071827 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (leasebu .bet) in TLS SNI (malware.rules)
  • 2071828 - ET WEB_SPECIFIC_APPS D-Link system_mgr.cgi Multiple Parameters Command Injection Attempt (CVE-2026-8273) (web_specific_apps.rules)
  • 2071829 - ET WEB_SPECIFIC_APPS D-Link account_mgr.cgi app Parameter Command Injection Attempt (CVE-2026-4209) (web_specific_apps.rules)

Disabled and modified rules:

  • 2071635 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules)
  • 2071636 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules)
  • 2071732 - ET MALWARE Lumma Stealer Domain in DNS Lookup (deckerh .cyou) (malware.rules)
  • 2071733 - ET MALWARE Lumma Stealer Domain in DNS Lookup (matchny .cyou) (malware.rules)
  • 2071743 - ET MALWARE Lumma Stealer Domain in TLS SNI (matchny .cyou) (malware.rules)
  • 2868249 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile_malware.rules)