Ruleset Update Summary - 2026/09/02 - v11272

Ruleset Updates
1

Summary:

24 new OPEN, 57 new PRO (24 + 33)

Added rules:

Open:

  • 2071887 - ET WEB_SPECIFIC_APPS Spring Framework Functional Web Frameworks Path Traversal (CVE-2024-38819) (web_specific_apps.rules)
  • 2071888 - ET INFO Observed DNS Query to Fake File Sharing Domain (filelu .cloud) (info.rules)
  • 2071889 - ET INFO Observed DNS Query File Sharing Domain (filelu .live) (info.rules)
  • 2071890 - ET INFO Observed DNS Query to File Sharing Domain (filelu .online) (info.rules)
  • 2071891 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .cloud) (info.rules)
  • 2071892 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .live) (info.rules)
  • 2071893 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .online) (info.rules)
  • 2071894 - ET INFO Observed DNS Query to File Sharing Domain (filelu .com) (info.rules)
  • 2071895 - ET INFO Observed DNS Query to File Sharing Domain (cdnfront .site) (info.rules)
  • 2071896 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (advd-api .horecaculinarystudio .com) (malware.rules)
  • 2071897 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (advd-api .horecaculinarystudio .com) (malware.rules)
  • 2071898 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (beginningboundewk .xyz) (malware.rules)
  • 2071899 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (beginningboundewk .xyz) in TLS SNI (malware.rules)
  • 2071900 - ET INFO Observed File Sharing Domain (filelu .com in TLS SNI) (info.rules)
  • 2071901 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bitchsafettyudjwu .shop) (malware.rules)
  • 2071902 - ET INFO Observed File Sharing Domain (cdnfront .site in TLS SNI) (info.rules)
  • 2071903 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bitchsafettyudjwu .shop) in TLS SNI (malware.rules)
  • 2071904 - ET WEB_SPECIFIC_APPS Atlassian MCP Server-side Request Forgery via HTTP Headers (CVE-2026-27826) M1 (web_specific_apps.rules)
  • 2071905 - ET WEB_SPECIFIC_APPS Atlassian MCP Server-side Request Forgery via HTTP Headers (CVE-2026-27826) M2 (web_specific_apps.rules)
  • 2071906 - ET MALWARE Etherhiding Domain in DNS Lookup (metrics-onclick .com) (malware.rules)
  • 2071907 - ET MALWARE Observed Etherhiding Domain (metrics-onclick .com in TLS SNI) (malware.rules)
  • 2071908 - ET WEB_SPECIFIC_APPS Langflow Unauthenticated Remote Code Execution (CVE-2026-0768) (web_specific_apps.rules)
  • 2071909 - ET HUNTING Script/Executable Downloaded from Filelu (hunting.rules)
  • 2071910 - ET HUNTING Script/Executable Downloaded from Filelu (cdnfront .site) (hunting.rules)

Pro:

  • 2868432 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868433 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868434 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868435 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868437 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868438 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868439 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868440 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868441 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868442 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868443 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868444 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868445 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868446 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868447 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868448 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868449 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868450 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868451 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868452 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868453 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868454 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868455 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868456 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868457 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868458 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868459 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868460 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868461 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868462 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868463 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868464 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868465 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)