Ruleset Update Summary - 2026/09/07 - v11277

Ruleset Updates
1

Summary:

0 new OPEN, 0 new PRO (0 + 0)

Modified inactive rules:

  • 2001417 - ET ADWARE_PUP E2give Related Receiving Config (adware_pup.rules)
  • 2001689 - ET WORM Potential MySQL bot scanning for SQL server (worm.rules)
  • 2003022 - ET CHAT Skype Bootstrap Node (udp) (chat.rules)
  • 2003238 - ET MALWARE W32.Downloader Tibs.jy Reporting to C&C (malware.rules)
  • 2003515 - ET MALWARE Snatch Reporting User Activity (malware.rules)
  • 2007664 - ET ADWARE_PUP AVSystemcare.com.com Fake Anti-Virus Product (adware_pup.rules)
  • 2007700 - ET MALWARE ExplorerHijack Trojan HTTP Checkin (malware.rules)
  • 2007712 - ET MALWARE Srizbi requesting template (malware.rules)
  • 2007768 - ET MALWARE Pakes Update Detected (malware.rules)
  • 2007917 - ET MALWARE Dropper-497 (Yumato) Initial Checkin (malware.rules)
  • 2007967 - ET MALWARE Universal1337 FTP Upload of Compromised Data (malware.rules)
  • 2007968 - ET MALWARE Universal1337 Email Upload of Compromised Data (malware.rules)
  • 2008042 - ET MALWARE Hupigon CnC Data Post (variant abb) (malware.rules)
  • 2008047 - ET MALWARE Egspy Infection Report via HTTP (malware.rules)
  • 2008260 - ET MALWARE Pointpack.kr Related Trojan Checkin (malware.rules)
  • 2008332 - ET MALWARE Steam Pass Stealer FTP Upload (malware.rules)
  • 2008347 - ET MALWARE Swizzor Checkin (malware.rules)
  • 2008370 - ET ADWARE_PUP Shopcenter.co .kr Spyware Install Report (adware_pup.rules)
  • 2008395 - ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL (3) (malware.rules)
  • 2008412 - ET MALWARE Trojan-Dropper.Win32.Small.avu HTTP Checkin (malware.rules)
  • 2008645 - ET MALWARE Spy-Net Trojan Connection (2) (malware.rules)
  • 2008666 - ET MALWARE Delf Key Checkin (Clicker.Win32.Delf.afl) (malware.rules)
  • 2009052 - ET MALWARE Hupigon System Stats Report (I-variant) (malware.rules)
  • 2009441 - ET MALWARE Swizzor Family GET (malware.rules)
  • 2009809 - ET ADWARE_PUP Adware/Antivirus360 Config to client (adware_pup.rules)
  • 2010065 - ET MALWARE SafeFighter Fake Scanner Installation in Progress (malware.rules)
  • 2010119 - ET WEB_SERVER xp_cmdshell Attempt in Cookie (web_server.rules)
  • 2010148 - ET MALWARE DHL Spam Inbound (malware.rules)
  • 2010380 - ET WEB_SERVER JBOSS/JMX REMOTE WAR deployment attempt (GET) (web_server.rules)
  • 2010786 - ET CHAT Facebook Chat (settings) (chat.rules)
  • 2011121 - ET EXPLOIT_KIT Phoenix Exploit Kit Facebook phishing page payload could be ZeuS (exploit_kit.rules)
  • 2011473 - ET MALWARE Antivirus2010 Checkin port 8082 (malware.rules)
  • 2011511 - ET DOS ntop Basic-Auth DOS inbound (dos.rules)
  • 2011512 - ET DOS ntop Basic-Auth DOS outbound (dos.rules)
  • 2011767 - ET MALWARE Avzhan DDOS Bot Inbound Hardcoded Malformed GET Request Denial Of Service Attack Detected (malware.rules)
  • 2011994 - ET FTP ProFTPD Backdoor Inbound Backdoor Open Request (ACIDBITCHEZ) (ftp.rules)
  • 2012276 - ET MALWARE USPS Inbound SPAM (malware.rules)
  • 2012319 - ET MALWARE IRS Inbound SMTP Malware (malware.rules)
  • 2012320 - ET MALWARE IRS Inbound SPAM (malware.rules)
  • 2012329 - ET MALWARE IRS Inbound SPAM variant 3 (malware.rules)
  • 2012388 - ET MALWARE USPS SPAM Inbound possible spyeye trojan (malware.rules)
  • 2012443 - ET MALWARE UPS Inbound bad attachment v.5 (malware.rules)
  • 2012444 - ET MALWARE UPS Inbound bad attachment v.6 (malware.rules)
  • 2012445 - ET MALWARE Post Express Inbound bad attachment (malware.rules)
  • 2012492 - ET MALWARE DHL Spam Inbound (malware.rules)
  • 2012493 - ET MALWARE DHL Spam Inbound (malware.rules)
  • 2012974 - ET MALWARE W32.Qakbot .cb File Extention FTP Upload (malware.rules)
  • 2012975 - ET MALWARE W32.Qakbot Seclog FTP Upload (malware.rules)
  • 2013188 - ET EXPLOIT VSFTPD Backdoor User Login Smiley (exploit.rules)
  • 2013236 - ET MALWARE Palevo (OUTBOUND) (malware.rules)
  • 2013329 - ET MALWARE Ruskill CnC Download Command 1 (malware.rules)
  • 2013330 - ET MALWARE Ruskill CnC Download Command 2 (malware.rules)
  • 2013331 - ET MALWARE Ruskill Reporting on Local Scans (malware.rules)
  • 2013346 - ET MALWARE PSW.Win32.Ruftar.lon File Stealer FTP File Upload (malware.rules)
  • 2013683 - ET MALWARE Win32.Parite Checkin SQL Database (malware.rules)
  • 2013755 - ET MALWARE Bundestrojaner (W32/R2D2 BTrojan) Inbound SRV-1 (malware.rules)
  • 2013756 - ET MALWARE Bundestrojaner (W32/R2D2 BTrojan) Outbound SRV-1 (malware.rules)
  • 2013793 - ET MALWARE Dropper.Win32.Npkon Client Checkin (malware.rules)
  • 2800446 - ETPRO SQL Application Server 10g OPMN Service Format String Vulnerability (sql.rules)
  • 2801003 - ETPRO SCADA CONTROL MICROSYSTEMS (Event 32) Change Time Attempt (scada.rules)
  • 2801004 - ETPRO SCADA_SPECIAL CONTROL MICROSYSTEMS (Event 31) Reboot or Restart (scada_special.rules)
  • 2801005 - ETPRO SCADA_SPECIAL CONTROL MICROSYSTEMS (Event 31) Reboot or Restart (scada_special.rules)
  • 2801027 - ETPRO SCADA CONTROL MICROSYSTEMS (Event 40)TCP UDP Port Change Attempt (scada.rules)
  • 2801094 - ETPRO SCADA_SPECIAL PROSOFT (Event 20) Function Not Available Error (scada_special.rules)
  • 2801095 - ETPRO SCADA_SPECIAL PROSOFT (Event 21) Point Not Available (scada_special.rules)
  • 2801163 - ETPRO SCADA SCHWEITZER (Event 41)Config File Change (scada.rules)
  • 2801169 - ETPRO SCADA_SPECIAL SCHWEITZER (Event 33) Date Change Attempt (scada_special.rules)
  • 2801171 - ETPRO SCADA_SPECIAL SCHWEITZER (Event 24) View Device Status (scada_special.rules)
  • 2801348 - ETPRO MALWARE Mariposa or Palevo Bot Response from Server (malware.rules)
  • 2801510 - ETPRO NETBIOS Multiple Load Library Vulns dwmapi.dll - SMB-DS ASCII (netbios.rules)
  • 2801511 - ETPRO NETBIOS Multiple Load Library Vulns dwmapi.dll - SMB-DS Unicode (netbios.rules)
  • 2801512 - ETPRO NETBIOS Multiple Load Library Vulns dwmapi.dll - SMB ASCII (netbios.rules)
  • 2801513 - ETPRO NETBIOS Multiple Load Library Vulns dwmapi.dll - SMB Unicode (netbios.rules)
  • 2801516 - ETPRO NETBIOS Adobe Illustrator Insecure Library Loading aires.dll - SMB-DS Unicode (netbios.rules)
  • 2801517 - ETPRO NETBIOS Adobe Illustrator Insecure Library Loading aires.dll - SMB-DS ASCII (netbios.rules)
  • 2801518 - ETPRO NETBIOS Adobe Illustrator Insecure Library Loading aires.dll - SMB Unicode (netbios.rules)
  • 2801519 - ETPRO NETBIOS Adobe Illustrator Insecure Library Loading aires.dll - SMB ASCII (netbios.rules)
  • 2801528 - ETPRO NETBIOS Microsoft Powerpoint pp4x322.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801529 - ETPRO NETBIOS Microsoft Powerpoint pp4x322.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801530 - ETPRO NETBIOS Microsoft Powerpoint pp4x322.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801531 - ETPRO NETBIOS Microsoft Powerpoint pp4x322.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801534 - ETPRO NETBIOS Microsoft Powerpoint msapsspc.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801535 - ETPRO NETBIOS Microsoft Powerpoint msapsspc.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801536 - ETPRO NETBIOS Microsoft Powerpoint msapsspc.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801537 - ETPRO NETBIOS Microsoft Powerpoint msapsspc.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801540 - ETPRO NETBIOS Microsoft Powerpoint schannel.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801541 - ETPRO NETBIOS Microsoft Powerpoint schannel.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801542 - ETPRO NETBIOS Microsoft Powerpoint schannel.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801543 - ETPRO NETBIOS Microsoft Powerpoint schannel.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801564 - ETPRO NETBIOS Microsoft Windows SDK for Windows 7 and NET Framework 4 GraphEdit measure.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801565 - ETPRO NETBIOS Microsoft Windows SDK for Windows 7 and NET Framework 4 GraphEdit measure.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801566 - ETPRO NETBIOS Microsoft Windows SDK for Windows 7 and NET Framework 4 GraphEdit measure.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801567 - ETPRO NETBIOS Microsoft Windows SDK for Windows 7 and NET Framework 4 GraphEdit measure.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801570 - ETPRO NETBIOS IBM Lotus Notes nnoteswc.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801571 - ETPRO NETBIOS IBM Lotus Notes nnoteswc.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801572 - ETPRO NETBIOS IBM Lotus Notes nnoteswc.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801573 - ETPRO NETBIOS IBM Lotus Notes nnoteswc.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801576 - ETPRO NETBIOS IBM Lotus Notes nlsxbe.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801577 - ETPRO NETBIOS IBM Lotus Notes nlsxbe.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801578 - ETPRO NETBIOS IBM Lotus Notes nlsxbe.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801579 - ETPRO NETBIOS IBM Lotus Notes nlsxbe.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801582 - ETPRO NETBIOS Multiple Load Library Vulns ibfs32.dll - SMB-DS ASCII (netbios.rules)
  • 2801583 - ETPRO NETBIOS Multiple Load Library Vulns ibfs32.dll - SMB-DS Unicode (netbios.rules)
  • 2801584 - ETPRO NETBIOS Multiple Load Library Vulns ibfs32.dll - SMB ASCII (netbios.rules)
  • 2801585 - ETPRO NETBIOS Multiple Load Library Vulns ibfs32.dll - SMB Unicode (netbios.rules)
  • 2801682 - ETPRO SCADA DNP3 Unsolicited Response Storm (scada.rules)
  • 2801692 - ETPRO SCADA DNP3 Points List Scan (scada.rules)
  • 2801693 - ETPRO SCADA DNP3 Function Code Scan (scada.rules)
  • 2801696 - ETPRO SCADA_SPECIAL DNP3 Unsolicited Response Storm (scada_special.rules)
  • 2801706 - ETPRO SCADA_SPECIAL DNP3 Points List Scan (scada_special.rules)
  • 2801707 - ETPRO SCADA_SPECIAL DNP3 Function Code Scan (scada_special.rules)
  • 2801718 - ETPRO SCADA Modbus TCP Non-Modbus Communication on TCP Port 502 (scada.rules)
  • 2801719 - ETPRO SCADA Modbus TCP Slave Device Busy Exception Code Delay (scada.rules)
  • 2801720 - ETPRO SCADA Modbus TCP Acknowledge Exception Code Delay (scada.rules)
  • 2801722 - ETPRO SCADA Modbus TCP Points List Scan (scada.rules)
  • 2801723 - ETPRO SCADA Modbus TCP Function Code Scan (scada.rules)
  • 2801724 - ETPRO SCADA WonderWare SuiteLink DOS Attempt (scada.rules)
  • 2801995 - ETPRO MALWARE Buzus/Bifrost Checkin (malware.rules)
  • 2801997 - ETPRO MALWARE Ardamax Keylogger Reporting (malware.rules)
  • 2802109 - ETPRO EXPLOIT CA Total Defense Suite UNCWS getDBConfigSettings Credential Information Disclosure (exploit.rules)
  • 2802195 - ETPRO MALWARE Backdoor.Win32.Muhaltick.A Checkin (malware.rules)
  • 2802900 - ETPRO MALWARE Trojan-PSW.Win32.QQShou.ape Checkin (malware.rules)
  • 2802904 - ETPRO SCADA 7T Interactive Graphical SCADA System Arbitrary File Read And Overwrite (scada.rules)
  • 2803080 - ETPRO EXPLOIT HP Performance Manager arbitrary file deletion (exploit.rules)
  • 2803096 - ETPRO EXPLOIT Sybase Adaptive Server Enterprise Backup Database Log Messages format string attempt (exploit.rules)
  • 2803105 - ETPRO DNS ISC BIND RRSIG RRsets Denial of Service UDP 1 (dns.rules)
  • 2803129 - ETPRO MALWARE Palevo CnC Response (malware.rules)
  • 2803149 - ETPRO MALWARE Win32.Otran/VBKrypt.cugx Checkin (malware.rules)
  • 2803654 - ETPRO MALWARE Sharepoint 2010 spsave Parameter XSS Injection Attempt (malware.rules)
  • 2803930 - ETPRO MALWARE Spy.Banker.K.Gen Checkin (malware.rules)
  • 2803965 - ETPRO SCADA IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS (scada.rules)