Ruleset Update Summary - 2026/08/28 - v11269

Ruleset Updates
1

Summary:

16 new OPEN, 29 new PRO (16 + 13)

Added rules:

Open:

  • 2071830 - ET INFO Microsoft Exchange Server MRSProxy NTLM Authentication (info.rules)
  • 2071831 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (methodpsdusx .shop) (malware.rules)
  • 2071832 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (methodpsdusx .shop) in TLS SNI (malware.rules)
  • 2071833 - ET EXPLOIT Microsoft Exchange Server MRSProxy Initial WCF Handshake (CVE-2026-62911) (exploit.rules)
  • 2071834 - ET EXPLOIT Microsoft Exchange Server MRSProxy Trigger File Write via PSTSession.Open() (CVE-2026-62911) (exploit.rules)
  • 2071835 - ET WEB_SPECIFIC_APPS Mennekes Amtron Authentication Bypass (CVE-2026-8979) (web_specific_apps.rules)
  • 2071836 - ET WEB_SPECIFIC_APPS Mennekes Amtron Privilege Escalation (CVE-2026-8980) M1 (web_specific_apps.rules)
  • 2071837 - ET WEB_SPECIFIC_APPS Mennekes Amtron Privilege Escalation (CVE-2026-8980) M2 (web_specific_apps.rules)
  • 2071838 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (preamp .givescash .com) (malware.rules)
  • 2071839 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (preamp .givescash .com) (malware.rules)
  • 2071840 - ET INFO Observed TonAPI Domain in DNS Lookup (tonviewer .com) (info.rules)
  • 2071841 - ET INFO Observed TonAPI Domain in TLS SNI (tonviewer .com) (info.rules)
  • 2071842 - ET INFO Observed TonAPI Domain in DNS Lookup (tonconsole .com) (info.rules)
  • 2071843 - ET INFO Observed TonAPI Domain in TLS SNI (tonconsole .com) (info.rules)
  • 2071844 - ET INFO Observed TonAPI Domain in DNS Lookup (tonapi .io) (info.rules)
  • 2071845 - ET INFO Observed TonAPI Domain in TLS SNI (tonapi .io) (info.rules)

Pro:

  • 2868388 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868389 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868390 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868391 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868392 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868393 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868394 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868395 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868396 - ETPRO MALWARE Observed DNS Query to Fake RMM Domain (malware.rules)
  • 2868397 - ETPRO MALWARE Observed Fake RMM Domain in TLS SNI (malware.rules)
  • 2868398 - ETPRO MALWARE Fake RMM CnC Version Check (malware.rules)
  • 2868399 - ETPRO MALWARE Fake RMM Victim Enroll via WebSocket (malware.rules)
  • 2868400 - ETPRO MALWARE Fake RMM CnC Activity (POST) (malware.rules)

Modified inactive rules:

  • 2866810 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2866819 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2866824 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2866826 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2866984 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2866993 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2866998 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867000 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867843 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867852 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867857 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867859 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867915 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867918 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2867921 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2867923 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2867998 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868007 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868014 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868211 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868220 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868225 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868227 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)