Ruleset Update Summary - 2026/09/01 - v11271

Ruleset Updates
1

Summary:

17 new OPEN, 26 new PRO (17 + 9)

Thanks @Cyderes

Added rules:

Open:

  • 2071870 - ET MALWARE TonRAT CnC Activity (Fetch Powershell) (malware.rules)
  • 2071871 - ET MALWARE TonRAT CnC Activity (Powershell Payload) (malware.rules)
  • 2071872 - ET WEB_SPECIFIC_APPS Proxmox VE 7.x Authentication Bypass (PSA-2026-00043-1) (web_specific_apps.rules)
  • 2071873 - ET WEB_SPECIFIC_APPS Paperclip AI Unauthenticated Remote Code Execution (CVE-2026-41679) (web_specific_apps.rules)
  • 2071874 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (dc .lesaray .com) (malware.rules)
  • 2071875 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (dc .lesaray .com) (malware.rules)
  • 2071876 - ET WEB_SPECIFIC_APPS Gogs Wiki Authenticated Arbitrary File Deletion via Path Traversal (CVE-2026-24135) (web_specific_apps.rules)
  • 2071877 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (instructionpxjc .shop) (malware.rules)
  • 2071878 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (instructionpxjc .shop) in TLS SNI (malware.rules)
  • 2071879 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (propermixturedwo .xyz) (malware.rules)
  • 2071880 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (propermixturedwo .xyz) in TLS SNI (malware.rules)
  • 2071881 - ET WEB_SPECIFIC_APPS Vaultwarden Unauthorized Cipher Enumeration (CVE-2026-26012) (web_specific_apps.rules)
  • 2071882 - ET MALWARE Grizzly Loader Custom HTTP Header Observed (X-Panel-Internal) (malware.rules)
  • 2071883 - ET MALWARE Grizzly Loader Custom HTTP Header Observed (X-Panel-Callback) (malware.rules)
  • 2071884 - ET MALWARE OnionDrop CnC Panel Checkin (malware.rules)
  • 2071885 - ET MALWARE OnionDrop CnC Panel Response (malware.rules)
  • 2071886 - ET MALWARE OnionDrop CnC Activity (POST) (malware.rules)

Pro:

  • 2868417 - ETPRO WEB_SPECIFIC_APPS Laravel Livewire Unauthenticated Remote Code Execution via Synthesizer Injection (CVE-2025-54068) (web_specific_apps.rules)
  • 2868418 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868419 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868420 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868421 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868422 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868423 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868424 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868425 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

Modified inactive rules:

  • 2868215 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)