Ruleset Update Summary - 2026/09/07 - v11276

Ruleset Updates
1

Summary:

0 new OPEN, 0 new PRO (0 + 0)

Modified inactive rules:

  • 2001116 - ET DNS Standard query response, Format error (dns.rules)
  • 2001117 - ET DNS Standard query response, Name Error (dns.rules)
  • 2001118 - ET DNS Standard query response, Not Implemented (dns.rules)
  • 2001119 - ET DNS Standard query response, Refused (dns.rules)
  • 2001882 - ET DOS ICMP Path MTU lowered below acceptable threshold (dos.rules)
  • 2002033 - ET MALWARE IRC Potential bot command response (malware.rules)
  • 2002192 - ET CHAT MSN status change (chat.rules)
  • 2002938 - ET MALWARE elitekeylogger v1.0 reporting - Inbound (malware.rules)
  • 2002940 - ET MALWARE XP keylogger v2.1 mail report - Inbound (malware.rules)
  • 2002941 - ET MALWARE elitekeylogger v1.0 reporting - Outbound (malware.rules)
  • 2002942 - ET MALWARE XP keylogger v2.1 mail report - Outbound (malware.rules)
  • 2002978 - ET MALWARE Banker.Delf Infection variant 2 - Sending Initial Email to Owner (malware.rules)
  • 2002980 - ET MALWARE Banker.Delf Infection variant 3 - Sending Initial Email to Owner (malware.rules)
  • 2003292 - ET WORM Allaple ICMP Sweep Ping Outbound (worm.rules)
  • 2003293 - ET WORM Allaple ICMP Sweep Reply Inbound (worm.rules)
  • 2003294 - ET WORM Allaple ICMP Sweep Ping Inbound (worm.rules)
  • 2003295 - ET WORM Allaple ICMP Sweep Reply Outbound (worm.rules)
  • 2007585 - ET MALWARE Win32.SkSocket C&C Connection (malware.rules)
  • 2007618 - ET MALWARE Storm Worm ICMP DDOS Traffic (malware.rules)
  • 2007673 - ET MALWARE E-Jihad 3.0 DNS Activity TCP (1) (malware.rules)
  • 2007780 - ET MALWARE Ssppyy.com Surveillance Agent Reporting via Email (malware.rules)
  • 2007858 - ET MALWARE Delf Keylog FTP Upload (malware.rules)
  • 2007918 - ET MALWARE Dropper-497 (Yumato) System Stats Report (malware.rules)
  • 2007930 - ET MALWARE Delf/Hupigon C&C Channel Version Report (malware.rules)
  • 2007949 - ET MALWARE Medbod UDP Phone Home Packet (malware.rules)
  • 2007974 - ET MALWARE Perfect Keylogger FTP Log Upload (malware.rules)
  • 2007979 - ET MALWARE Backdoor.Win32.VB.brg C&C Reporting Version (malware.rules)
  • 2007981 - ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Acknowledge (malware.rules)
  • 2008025 - ET MALWARE Turkojan C&C Logs Parse Response Response (LOGS1) (malware.rules)
  • 2008028 - ET MALWARE Turkojan C&C Browse Drive Command Response (metin) (malware.rules)
  • 2008031 - ET MALWARE Dorf/Win32.Inject.adt C&C Communication Outbound (malware.rules)
  • 2008104 - ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Outbound (malware.rules)
  • 2008105 - ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Inbound (malware.rules)
  • 2008106 - ET MALWARE Bobax/Kraken/Oderoor TCP 447 CnC Channel Initial Packet Inbound (malware.rules)
  • 2008237 - ET MALWARE Pass Stealer FTP Upload (malware.rules)
  • 2008258 - ET MALWARE Hupigon CnC Communication (variant bysj) (malware.rules)
  • 2008273 - ET MALWARE Bifrose Connect to Controller (malware.rules)
  • 2008447 - ET DNS Query Responses with 3 RR’s set (50+ in 2 seconds) - possible NS RR Cache Poisoning Attempt (dns.rules)
  • 2008449 - ET MALWARE Keylogger.ane Checkin (malware.rules)
  • 2008450 - ET MALWARE Donbot Connect to CnC (malware.rules)
  • 2008451 - ET MALWARE Donbot Report to CnC (malware.rules)
  • 2008475 - ET DNS Query Responses with 3 RR’s set (50+ in 2 seconds) - possible A RR Cache Poisoning Attempt (dns.rules)
  • 2008507 - ET MALWARE Backdoor.Win32.VB.fdi Bot Reporting to Controller (malware.rules)
  • 2008540 - ET MALWARE Hupigon.dkxh Checkin to CnC (malware.rules)
  • 2008573 - ET MALWARE Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch) (malware.rules)
  • 2008642 - ET MALWARE Keylogger PRO GOLD Post (malware.rules)
  • 2008727 - ET MALWARE Gimmiv Infection Ping Inbound (malware.rules)
  • 2008733 - ET MALWARE Trojan.Win32.Regrun.ro FTP connection detected (malware.rules)
  • 2008841 - ET MALWARE Trojan-PWS.Win32.Small.gs Passwords leak over FTP (malware.rules)
  • 2008905 - ET MALWARE Trojan.Delf-5496 Checkin Error (malware.rules)
  • 2008906 - ET MALWARE Trojan.Delf-5496 Egg Request (malware.rules)
  • 2008907 - ET MALWARE Trojan.Delf-5496 File Manager Access Report (malware.rules)
  • 2008950 - ET MALWARE Trojan.Win32.Small.yml client registration (malware.rules)
  • 2008951 - ET MALWARE Trojan.Win32.Small.yml client command (malware.rules)
  • 2009077 - ET MALWARE TROJ_INJECT.NI Update Request (malware.rules)
  • 2009129 - ET MALWARE Bifrose Response from Controller (PING PONG) (malware.rules)
  • 2009242 - ET MALWARE LDPinch Reporting infection via Email (malware.rules)
  • 2009581 - ET ATTACK_RESPONSE Metasploit/Meterpreter - Sending metsrv.dll to Compromised Host (attack_response.rules)
  • 2009824 - ET MALWARE Downloader.Win32.Delf followon POST Data PUSH Packet (malware.rules)
  • 2009863 - ET MALWARE Banker Trojan CnC Hello Command (malware.rules)
  • 2010650 - ET MALWARE Lethic Spambot CnC Bot Command Confirmation (malware.rules)
  • 2010651 - ET MALWARE Lethic Spambot CnC Bot Transaction Relay (malware.rules)
  • 2010731 - ET FTP FTP CWD command attempt without login (ftp.rules)
  • 2010755 - ET DOS IBM DB2 kuddb2 Remote Denial of Service Attempt (dos.rules)
  • 2012054 - ET SMTP Potential Exim HeaderX with run exploit attempt (smtp.rules)
  • 2800323 - ETPRO RPC Sun Solaris rpc.ypupdated Command Injection Vulnerability (rpc.rules)
  • 2800324 - ETPRO RPC Sun Solaris rpc.ypupdated Command Injection Vulnerability (rpc.rules)
  • 2800447 - ETPRO SQL Oracle Application Server 10g OPMN Service Format String Vulnerability (sql.rules)
  • 2800498 - ETPRO VOIP Digium Asterisk IAX2 Call Number Denial Of Service (voip.rules)
  • 2801016 - ETPRO SCADA CONTROL MICROSYSTEMS (Event 21) Point Not Available Error (scada.rules)
  • 2801049 - ETPRO SCADA JOHNSON CONTROLS (Event 9)Password Change Attempt (scada.rules)
  • 2801050 - ETPRO SCADA JOHNSON CONTROLS (Event 1)Failed Login (scada.rules)
  • 2801051 - ETPRO SCADA JOHNSON CONTROLS (Event 33)Change Date Attempt (scada.rules)
  • 2801052 - ETPRO SCADA JOHNSON CONTROLS (Event 32)Change Time Attempt (scada.rules)
  • 2801053 - ETPRO SCADA JOHNSON CONTROLS (Event 2)Successful Login (scada.rules)
  • 2801054 - ETPRO SCADA JOHNSON CONTROLS (Event 31)Reboot or Restart (scada.rules)
  • 2801126 - ETPRO SCADA SCHWEITZER Invalid Password Attempts (scada.rules)
  • 2801127 - ETPRO SCADA SCHWEITZER Access Denied detected after 3 login attempts (scada.rules)
  • 2801129 - ETPRO SCADA SCHWEITZER SEL2032-Date Change was Successful (scada.rules)
  • 2801130 - ETPRO SCADA SCHWEITZER SEL2032-Unsuccessful attempt to change date (scada.rules)
  • 2801134 - ETPRO SCADA SCHWEITZER SEL2032-Modem Status Change Attempt (scada.rules)
  • 2801135 - ETPRO SCADA SCHWEITZER SEL2032-Modem Status Changed (scada.rules)
  • 2801136 - ETPRO SCADA SCHWEITZER SEL2032-Password function detected (scada.rules)
  • 2801137 - ETPRO SCADA SCHWEITZER SEL2032-Passwords were viewed (scada.rules)
  • 2801138 - ETPRO SCADA SCHWEITZER SEL2032-Access Level 1/2 Password Changed (scada.rules)
  • 2801139 - ETPRO SCADA SCHWEITZER SEL2032-Access Level 1 or 2 Password Disabled (scada.rules)
  • 2801140 - ETPRO SCADA SCHWEITZER SEL2032-Time Command Detected (scada.rules)
  • 2801141 - ETPRO SCADA SCHWEITZER SEL2032-Time Change was Successful (scada.rules)
  • 2801142 - ETPRO SCADA SCHWEITZER SEL2032-Unsuccessful attempt to change time (scada.rules)
  • 2801151 - ETPRO SCADA SCHWEITZER SEL2032-IP Address Change Attempt Detected (scada.rules)
  • 2801152 - ETPRO SCADA SCHWEITZER SEL2032-IP Address Change Detected (scada.rules)