Ruleset Update Summary - 2026/08/31 - v11270

Ruleset Updates
1

Summary:

37 new OPEN, 53 new PRO (37 + 16)

Added rules:

Open:

  • 2001253 - ET RETIRED Yahoo IM successful logon (retired.rules)
  • 2001254 - ET RETIRED Yahoo IM voicechat (retired.rules)
  • 2001255 - ET RETIRED Yahoo IM ping (retired.rules)
  • 2001256 - ET RETIRED Yahoo IM conference invitation (retired.rules)
  • 2001257 - ET RETIRED Yahoo IM conference logon success (retired.rules)
  • 2001258 - ET RETIRED Yahoo IM conference message (retired.rules)
  • 2001259 - ET RETIRED Yahoo IM file transfer request (retired.rules)
  • 2001260 - ET RETIRED Yahoo IM message (retired.rules)
  • 2001261 - ET RETIRED Yahoo IM successful chat join (retired.rules)
  • 2001262 - ET RETIRED Yahoo IM conference offer invitation (retired.rules)
  • 2001263 - ET RETIRED Yahoo IM conference request (retired.rules)
  • 2001264 - ET RETIRED Yahoo IM conference watch (retired.rules)
  • 2001427 - ET RETIRED Yahoo IM Unavailable Status (retired.rules)
  • 2002659 - ET RETIRED Yahoo IM Client Install (retired.rules)
  • 2071846 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (candidaiteopwm .shop) (malware.rules)
  • 2071847 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (candidaiteopwm .shop) in TLS SNI (malware.rules)
  • 2071848 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (racklilekwqp .shop) (malware.rules)
  • 2071849 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (racklilekwqp .shop) in TLS SNI (malware.rules)
  • 2071850 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scenarriotdpq .shop) (malware.rules)
  • 2071851 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (scenarriotdpq .shop) in TLS SNI (malware.rules)
  • 2071852 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (pa-upd .mariomilan .com) (malware.rules)
  • 2071853 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (pa-upd .mariomilan .com) (malware.rules)
  • 2071854 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hightpuredospzv .shop) (malware.rules)
  • 2071855 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (hightpuredospzv .shop) in TLS SNI (malware.rules)
  • 2071856 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mundannetransuq .shop) (malware.rules)
  • 2071857 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mundannetransuq .shop) in TLS SNI (malware.rules)
  • 2071858 - ET WEB_SPECIFIC_APPS Gitea Unauthenticated Remote Code Execution via diffpatch Endpoint (CVE-2026-60004) (web_specific_apps.rules)
  • 2071859 - ET WEB_SPECIFIC_APPS PaperCut NG/MF Authentication Bypass via Apache Tapestry page/component Routing Confusion (CVE-2026-81578) M1 (web_specific_apps.rules)
  • 2071860 - ET WEB_SPECIFIC_APPS PaperCut NG/MF Authentication Bypass via Apache Tapestry page/component Routing Confusion (CVE-2026-81578) M2 (web_specific_apps.rules)
  • 2071861 - ET MALWARE Grizzly Loader CnC Checkin (POST) (malware.rules)
  • 2071862 - ET ATTACK_RESPONSE Grizzly Loader PowerShell Script Inbound (attack_response.rules)
  • 2071863 - ET MALWARE Grizzly Loader CnC X-Panel-Callback (POST) (malware.rules)
  • 2071864 - ET MALWARE Grizzly Loader Config Inbound M1 (malware.rules)
  • 2071865 - ET MALWARE Grizzly Loader Config Inbound M2 (malware.rules)
  • 2071866 - ET MALWARE Grizzly Loader Payload Request (malware.rules)
  • 2071867 - ET HUNTING Grizzly Loader Style DNS Lookup M1 (hunting.rules)
  • 2071868 - ET HUNTING Grizzly Loader Style DNS Lookup M2 (hunting.rules)

Pro:

  • 2868401 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868402 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868403 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868404 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868405 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868406 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868407 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868408 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868409 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868410 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868411 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868412 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868413 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868414 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868415 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868416 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

Modified inactive rules:

  • 2071732 - ET MALWARE Lumma Stealer Domain in DNS Lookup (deckerh .cyou) (malware.rules)
  • 2071733 - ET MALWARE Lumma Stealer Domain in DNS Lookup (matchny .cyou) (malware.rules)
  • 2868211 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868225 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)

Disabled and modified rules:

  • 2071742 - ET MALWARE Lumma Stealer Domain in TLS SNI (deckerh .cyou) (malware.rules)

Removed rules:

  • 2001254 - ET CHAT Yahoo IM voicechat (chat.rules)
  • 2001255 - ET CHAT Yahoo IM ping (chat.rules)
  • 2001256 - ET CHAT Yahoo IM conference invitation (chat.rules)
  • 2001257 - ET CHAT Yahoo IM conference logon success (chat.rules)
  • 2001258 - ET CHAT Yahoo IM conference message (chat.rules)
  • 2001259 - ET CHAT Yahoo IM file transfer request (chat.rules)
  • 2001260 - ET CHAT Yahoo IM message (chat.rules)
  • 2001262 - ET CHAT Yahoo IM conference offer invitation (chat.rules)
  • 2001263 - ET CHAT Yahoo IM conference request (chat.rules)
  • 2001264 - ET CHAT Yahoo IM conference watch (chat.rules)
  • 2001427 - ET CHAT Yahoo IM Unavailable Status (chat.rules)
  • 2002659 - ET CHAT Yahoo IM Client Install (chat.rules)
  • 2102451 - GPL CHAT Yahoo IM voicechat (chat.rules)
  • 2102452 - GPL CHAT Yahoo IM ping (chat.rules)
  • 2102453 - GPL CHAT Yahoo IM conference invitation (chat.rules)
  • 2102454 - GPL CHAT Yahoo IM conference logon success (chat.rules)
  • 2102455 - GPL CHAT Yahoo IM conference message (chat.rules)
  • 2102458 - GPL CHAT Yahoo IM successful chat join (chat.rules)
  • 2102459 - GPL CHAT Yahoo IM conference offer invitation (chat.rules)
  • 2102460 - GPL CHAT Yahoo IM conference request (chat.rules)
  • 2102461 - GPL CHAT Yahoo IM conference watch (chat.rules)