Ruleset Update Summary - 2026/09/03 - v11273

Ruleset Updates
1

Summary:

8 new OPEN, 32 new PRO (8 + 24)

Added rules:

Open:

  • 2071911 - ET MALWARE TonRAT CnC Request to TonAPI Dead Drop Resolver (malware.rules)
  • 2071912 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (panel-api .myezwebhost .com) (malware.rules)
  • 2071913 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (panel-api .myezwebhost .com) (malware.rules)
  • 2071914 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiglen .sbs) (exploit_kit.rules)
  • 2071915 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (guiglen .sbs) (exploit_kit.rules)
  • 2071916 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (employeedscratshj .shop) (malware.rules)
  • 2071917 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (employeedscratshj .shop) in TLS SNI (malware.rules)
  • 2071918 - ET ATTACK_RESPONSE Observed Portuguese JS Dropper Inbound (attack_response.rules)

Pro:

  • 2868466 - ETPRO MALWARE Observed DNS Query to TA495 Domain (malware.rules)
  • 2868467 - ETPRO MALWARE Observed DNS Query to TA495 Domain (malware.rules)
  • 2868468 - ETPRO MALWARE Observed TA395 Domain in TLS SNI (malware.rules)
  • 2868469 - ETPRO MALWARE Observed TA395 Domain in TLS SNI (malware.rules)
  • 2868470 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868471 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868472 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868473 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868474 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868475 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868476 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868477 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868478 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868479 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile_malware.rules)
  • 2868480 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile_malware.rules)
  • 2868481 - ETPRO MOBILE_MALWARE Trojan-Dropper.AndroidOS.Hqwar.cf DNS Query (mobile_malware.rules)
  • 2868482 - ETPRO MALWARE TA395 Victim GET CnC Server Status (malware.rules)
  • 2868483 - ETPRO MALWARE TA395 Victim GET Commands from CnC Server (malware.rules)
  • 2868484 - ETPRO MALWARE TA395 CnC Commands Inbound (malware.rules)
  • 2868485 - ETPRO MALWARE TA395 CnC File Exfiltration (POST) (malware.rules)
  • 2868486 - ETPRO MALWARE TA395 CnC Exfil Response Inbound (malware.rules)
  • 2868487 - ETPRO MALWARE TA395 Victim CnC Registration (malware.rules)
  • 2868488 - ETPRO MALWARE TA395 Victim Registration Response From CnC Server (malware.rules)
  • 2868489 - ETPRO MALWARE TA395 Victim CnC HeartBeat (malware.rules)