# Ruleset Update Summary - 2026/09/07 - v11282 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 7, 2026, 2:31pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11282/3446 "2026-09-07T14:31:32Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 7, 2026, 2:31pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11282/3446/1 "2026-09-07T14:31:32Z")
## Summary: 0 new OPEN, 0 new PRO (0 + 0) * * * ## Modified inactive rules: - 2016142 - ET EXPLOIT\_KIT Sweet Orange Java payload request (2) (exploit\_kit.rules) - 2016174 - ET EXPLOIT\_KIT DRIVEBY RedKit - Landing Page (exploit\_kit.rules) - 2016180 - ET SNMP missing community string attempt 3 (snmp.rules) - 2016190 - ET EXPLOIT\_KIT DRIVEBY SPL - Landing Page Received (exploit\_kit.rules) - 2016191 - ET EXPLOIT\_KIT CoolEK - Landing Page Received (exploit\_kit.rules) - 2016211 - ET MALWARE W32/Karagany.Downloader CnC Beacon (malware.rules) - 2016212 - ET MALWARE BroBot POST (malware.rules) - 2016227 - ET EXPLOIT Metasploit Landing Page (CVE-2013-0422) (exploit.rules) - 2016240 - ET EXPLOIT\_KIT Impact Exploit Kit Class Download (exploit\_kit.rules) - 2016247 - ET EXPLOIT\_KIT StyX Landing Page (exploit\_kit.rules) - 2016249 - ET EXPLOIT\_KIT Redkit Class Request (1) (exploit\_kit.rules) - 2016250 - ET EXPLOIT\_KIT Redkit Class Request (2) (exploit\_kit.rules) - 2016255 - ET EXPLOIT\_KIT Red Dot Exploit Kit Binary Payload Request (exploit\_kit.rules) - 2016283 - ET WEB\_SPECIFIC\_APPS Openconstructor CMS keyword Parameter Cross Site Scripting Attempt (web\_specific\_apps.rules) - 2016293 - ET MALWARE RevProxy - ClickFraud - MIDUIDEND (malware.rules) - 2016298 - ET WEB\_CLIENT Malicious iframe (web\_client.rules) - 2016299 - ET EXPLOIT\_KIT Redkit Class Request (3) (exploit\_kit.rules) - 2016305 - ET WEB\_SERVER Ruby on Rails RCE Attempt Inbound (CVE-2013-0333) (web\_server.rules) - 2016306 - ET EXPLOIT\_KIT JDB Exploit Kit Landing URL structure (exploit\_kit.rules) - 2016319 - ET EXPLOIT\_KIT Impact Exploit Kit Landing Page (exploit\_kit.rules) - 2016337 - ET WEB\_SPECIFIC\_APPS WordPress Chocolate WP Theme src Cross Site Scripting Attempt (web\_specific\_apps.rules) - 2016344 - ET MOBILE\_MALWARE Android/Fakelash.A!tr.spy Checkin (mobile\_malware.rules) - 2016345 - ET MOBILE\_MALWARE DroidKungFu Variant (mobile\_malware.rules) - 2016348 - ET EXPLOIT\_KIT WhiteHole Exploit Landing Page (exploit\_kit.rules) - 2016349 - ET EXPLOIT\_KIT WhiteHole Exploit Kit Jar Request (exploit\_kit.rules) - 2016350 - ET EXPLOIT\_KIT WhiteHole Exploit Kit Payload Download (exploit\_kit.rules) - 2016353 - ET EXPLOIT\_KIT Styx Exploit Kit Landing Applet With Getmyfile.exe Payload (exploit\_kit.rules) - 2016357 - ET EXPLOIT\_KIT CritXPack - URI - jpfoff.php (exploit\_kit.rules) - 2016365 - ET CURRENT\_EVENTS CritXPack Jar Request (3) (current\_events.rules) - 2016371 - ET EXPLOIT\_KIT Exploit Kit Java jpg download (exploit\_kit.rules) - 2016380 - ET EXPLOIT\_KIT Sakura Exploit Kit Encrypted Binary (1) (exploit\_kit.rules) - 2016393 - ET EXPLOIT\_KIT Impact Exploit Kit Landing Page (exploit\_kit.rules) - 2016396 - ET WEB\_CLIENT Exploit Specific Uncompressed Flash (CVE-2013-0634) (web\_client.rules) - 2016397 - ET WEB\_CLIENT Exploit Specific Uncompressed Flash Inside of OLE (CVE-2013-0634) (web\_client.rules) - 2016400 - ET WEB\_CLIENT Flash Action Script Invalid Regex (CVE-2013-0634) (web\_client.rules) - 2016401 - ET WEB\_CLIENT Flash Action Script Invalid Regex (CVE-2013-0634) (web\_client.rules) - 2016412 - ET EXPLOIT\_KIT TDS Vdele (exploit\_kit.rules) - 2016426 - ET EXPLOIT\_KIT CoolEK landing applet plus class Feb 18 2013 (exploit\_kit.rules) - 2016444 - ET MALWARE STARSYPOUND Client Checkin (malware.rules) - 2016498 - ET EXPLOIT\_KIT Styx Exploit Kit Landing Applet With Payload (exploit\_kit.rules) - 2016511 - ET EXPLOIT Successful Compromise svchost.jpg Beacon - Java Zeroday (exploit.rules) - 2016514 - ET EXPLOIT\_KIT CrimeBoss - Java Exploit - jhan.jar (exploit\_kit.rules) - 2016560 - ET EXPLOIT\_KIT GonDadEK Plugin Detect March 11 2013 (exploit\_kit.rules) - 2016567 - ET MALWARE Win32/Urausy.C Checkin 2 (malware.rules) - 2016585 - ET EXPLOIT\_KIT Sweet Orange applet with obfuscated URL March 03 2013 (exploit\_kit.rules) - 2016593 - ET EXPLOIT\_KIT RedDotv2 Java Check-in (exploit\_kit.rules) - 2016594 - ET CURRENT\_EVENTS RedDotv2 Jar March 18 2013 (current\_events.rules) - 2016598 - ET EXPLOIT\_KIT CrimeBoss - Java Exploit - jmx.jar (exploit\_kit.rules) - 2016640 - ET EXPLOIT\_KIT Watering Hole applet name AppletLow.jar (exploit\_kit.rules) - 2016655 - ET EXPLOIT\_KIT Sweet Orange Java obfuscated binary (3) (exploit\_kit.rules) - 2016658 - ET RETIRED [CrowdStrike] ANCHOR PANDA - PoisonIvy Keep-Alive - From Victim (retired.rules) - 2016676 - ET WEB\_SERVER SQL Errors in HTTP 200 Response (ORA-) (web\_server.rules) - 2016677 - ET WEB\_SERVER SQL Errors in HTTP 500 Response (ORA-) (web\_server.rules) - 2016705 - ET EXPLOIT\_KIT Sweet Orange applet with obfuscated URL April 01 2013 (exploit\_kit.rules) - 2016708 - ET EXPLOIT\_KIT CrimeBoss Recent Jar (3) (exploit\_kit.rules) - 2016709 - ET EXPLOIT\_KIT CrimeBoss Recent Jar (4) (exploit\_kit.rules) - 2016716 - ET EXPLOIT\_KIT BHEK q.php iframe inbound (exploit\_kit.rules) - 2016717 - ET EXPLOIT\_KIT BHEK ff.php iframe inbound (exploit\_kit.rules) - 2016718 - ET EXPLOIT\_KIT BHEK q.php iframe outbound (exploit\_kit.rules) - 2016719 - ET EXPLOIT\_KIT BHEK ff.php iframe outbound (exploit\_kit.rules) - 2016726 - ET EXPLOIT\_KIT Potential Fiesta Flash Exploit (exploit\_kit.rules) - 2016733 - ET EXPLOIT\_KIT Sakura encrypted binary (2) (exploit\_kit.rules) - 2016735 - ET EXPLOIT\_KIT GonDadEK Java Exploit Requested (exploit\_kit.rules) - 2016736 - ET EXPLOIT\_KIT GonDadEK Java Exploit Requested (exploit\_kit.rules) - 2016737 - ET EXPLOIT\_KIT GonDadEK Kit Jar (exploit\_kit.rules) - 2016748 - ET MALWARE RansomCrypt Intial Check-in (malware.rules) - 2016781 - ET EXPLOIT\_KIT Sakura obfuscated javascript Apr 21 2013 (exploit\_kit.rules) - 2016784 - ET EXPLOIT\_KIT Fiesta - Payload - flashplayer11 (exploit\_kit.rules) - 2016785 - ET EXPLOIT\_KIT Sakura - Java Exploit Recievied (exploit\_kit.rules) - 2016786 - ET EXPLOIT\_KIT Sakura - Payload Requested (exploit\_kit.rules) - 2016787 - ET EXPLOIT\_KIT Sakura - Payload Downloaded (exploit\_kit.rules) - 2016791 - ET EXPLOIT\_KIT Sakura - Landing Page - Received (exploit\_kit.rules) - 2016807 - ET EXPLOIT\_KIT Eval With Base64.decode seen in DOL Watering Hole Attack 05/01/13 (exploit\_kit.rules) - 2016816 - ET MALWARE Variant.Zusy.45802 Checkin (malware.rules) - 2016820 - ET MALWARE DEEP PANDA Checkin 2 (malware.rules) - 2016830 - ET WEB\_CLIENT Injection - var j=0 (web\_client.rules) - 2016837 - ET MALWARE Alina Checkin (malware.rules) - 2016840 - ET EXPLOIT\_KIT FlimKit Landing (exploit\_kit.rules) - 2016851 - ET CURRENT\_EVENTS Winwebsec/Zbot/Luder Checkin Response (current\_events.rules) - 2016852 - ET EXPLOIT\_KIT Sakura obfuscated javascript May 10 2013 (exploit\_kit.rules) - 2016860 - ET WEB\_CLIENT Sweet Orange Landing Page May 16 2013 (web\_client.rules) - 2016923 - ET EXPLOIT\_KIT KaiXin Exploit Kit Java Class 1 May 24 2013 (exploit\_kit.rules) - 2016924 - ET EXPLOIT\_KIT KaiXin Exploit Kit Java Class 2 May 24 2013 (exploit\_kit.rules) - 2016925 - ET EXPLOIT\_KIT KaiXin Exploit Landing Page 1 May 24 2013 (exploit\_kit.rules) - 2016926 - ET EXPLOIT\_KIT KaiXin Exploit Landing Page 2 May 24 2013 (exploit\_kit.rules) - 2016937 - ET WEB\_SERVER SQL Injection List Priveleges Attempt (web\_server.rules) - 2016942 - ET EXPLOIT\_KIT Sakura - Landing Page - Received May 29 2013 (exploit\_kit.rules) - 2016943 - ET EXPLOIT\_KIT Sakura - Payload Requested (exploit\_kit.rules) - 2016945 - ET EXPLOIT\_KIT Sakura encrypted binary (2) (exploit\_kit.rules) - 2016952 - ET EXPLOIT\_KIT Probable Nuclear exploit kit landing page (exploit\_kit.rules) - 2016964 - ET EXPLOIT\_KIT CritX/SafePack Reporting Plugin Detect Data June 03 2013 (exploit\_kit.rules) - 2017022 - ET EXPLOIT\_KIT CritX/SafePack/FlashPack URI Format June 17 2013 1 (exploit\_kit.rules) - 2017023 - ET EXPLOIT\_KIT CritX/SafePack/FlashPack URI Format June 17 2013 2 (exploit\_kit.rules) - 2017024 - ET CURRENT\_EVENTS CritX/SafePack/FlashPack URI Format June 17 2013 3 (current\_events.rules) - 2017032 - ET WEB\_CLIENT MALVERTISING Flash - URI - /loading?vkn= (web\_client.rules) - 2017035 - ET WEB\_CLIENT Malicious Redirect June 18 2013 (web\_client.rules) - 2017036 - ET MALWARE Activity related to APT.Seinup Checkin 1 (malware.rules) - 2017037 - ET EXPLOIT Javadoc API Redirect CVE-2013-1571 (exploit.rules) - 2017038 - ET EXPLOIT\_KIT RedKit Jar Download June 20 2013 (exploit\_kit.rules) - 2017040 - ET EXPLOIT\_KIT Rawin Exploit Kit Landing URI Struct (exploit\_kit.rules) - 2017041 - ET EXPLOIT\_KIT Rawin Exploit Kit Jar 1.7.x (exploit\_kit.rules) - 2017042 - ET EXPLOIT\_KIT Rawin Exploit Kit Jar 1.6 (Old) (exploit\_kit.rules) - 2017043 - ET EXPLOIT\_KIT Rawin Exploit Kit Jar 1.6 (New) (exploit\_kit.rules) - 2017044 - ET EXPLOIT\_KIT Rawin Exploit Kit Jar 1.6 (New) (exploit\_kit.rules) - 2017052 - ET RETIRED PoisonIvy [victim beacon] (retired.rules) - 2017053 - ET RETIRED PoisonIvy [server response] (retired.rules) - 2017055 - ET MALWARE AryaN IRC bot CnC1 (malware.rules) - 2017056 - ET MALWARE AryaN IRC bot CnC2 (malware.rules) - 2017057 - ET MALWARE AryaN IRC bot Download and Execute Scheduled file command (malware.rules) - 2017058 - ET MALWARE AryaN IRC bot Flood command (malware.rules) - 2017059 - ET MALWARE AryaN IRC bot Botkill command (malware.rules) - 2017063 - ET EXPLOIT SolusVM WHMCS CURL Multi-part Boundary Issue (exploit.rules) - 2017064 - ET EXPLOIT\_KIT Cool/BHEK/Goon Applet with Alpha-Numeric Encoded HTML entity (exploit\_kit.rules) - 2017069 - ET EXPLOIT\_KIT Neutrino Exploit Kit Clicker.php TDS (exploit\_kit.rules) - 2017070 - ET EXPLOIT\_KIT Applet tag in jjencode as (as seen in Dotka Chef EK) (exploit\_kit.rules) - 2017071 - ET EXPLOIT\_KIT Neutrino Exploit Kit XOR decodeURIComponent (exploit\_kit.rules) - 2017073 - ET EXPLOIT\_KIT Cool Exploit Kit iframe with obfuscated Java version check Jun 26 2013 (exploit\_kit.rules) - 2017075 - ET EXPLOIT\_KIT Sweet Orange applet structure June 27 2013 (exploit\_kit.rules) - 2017078 - ET EXPLOIT\_KIT Lucky7 Java Exploit URI Struct June 28 2013 (exploit\_kit.rules) - 2017079 - ET EXPLOIT\_KIT Sibhost Status Check GET Jul 01 2013 (exploit\_kit.rules) - 2017092 - ET EXPLOIT\_KIT CritX/SafePack/FlashPack Jar Download Jul 01 2013 (exploit\_kit.rules) - 2017093 - ET EXPLOIT\_KIT CritX/SafePack/FlashPack EXE Download Jul 01 2013 (exploit\_kit.rules) - 2017106 - ET EXPLOIT\_KIT FlimKit Landing Applet Jul 05 2013 (exploit\_kit.rules) - 2017110 - ET EXPLOIT\_KIT Sweet Orange applet structure Jul 05 2013 (exploit\_kit.rules) - 2017113 - ET MALWARE VBulletin Backdoor C2 Domain (malware.rules) - 2017114 - ET EXPLOIT\_KIT Styx iframe with obfuscated Java version check Jul 04 2013 (exploit\_kit.rules) - 2017115 - ET EXPLOIT\_KIT Sweet Orange applet July 08 2013 (exploit\_kit.rules) - 2017116 - ET WEB\_CLIENT Sweet Orange Landing with Applet July 08 2013 (web\_client.rules) - 2017118 - ET EXPLOIT\_KIT Sibhost Zip as Applet Archive July 08 2013 (exploit\_kit.rules) - 2017119 - ET EXPLOIT\_KIT CritX/SafePack Java Exploit Payload June 03 2013 (exploit\_kit.rules) - 2017125 - ET WEB\_CLIENT Probable FlimKit Redirect July 10 2013 (web\_client.rules) - 2017126 - ET WEB\_CLIENT FlimKit Landing July 10 2013 (web\_client.rules) - 2017138 - ET EXPLOIT\_KIT g01pack - Java JNLP Requested (exploit\_kit.rules) - 2017139 - ET EXPLOIT\_KIT DotkaChef JJencode Script URI Struct (exploit\_kit.rules) - 2017146 - ET WEB\_SERVER HTTP Request Smuggling Attempt - Double Content-Length Headers (web\_server.rules) - 2017147 - ET WEB\_SERVER HTTP Request Smuggling Attempt - Two Transfer-Encoding Values Specified (web\_server.rules) - 2017149 - ET WEB\_CLIENT DRIVEBY Redirection - phpBB Injection (web\_client.rules) - 2017151 - ET EXPLOIT\_KIT Styx PDF July 15 2013 (exploit\_kit.rules) - 2017152 - ET EXPLOIT\_KIT FlimKit Jar URI Struct (exploit\_kit.rules) - 2017153 - ET EXPLOIT\_KIT FlimKit JNLP URI Struct (exploit\_kit.rules) - 2017154 - ET DOS Squid-3.3.5 DoS (dos.rules) - 2017168 - ET WEB\_CLIENT FlimKit Landing 07/22/13 (web\_client.rules) - 2017169 - ET WEB\_CLIENT FlimKit Landing 07/22/13 2 (web\_client.rules) - 2017170 - ET WEB\_CLIENT FlimKit Landing 07/22/13 3 (web\_client.rules) - 2017171 - ET WEB\_CLIENT FlimKit Landing 07/22/13 4 (web\_client.rules) - 2017177 - ET EXPLOIT\_KIT DRIVEBY Rawin - Landing Page Received (exploit\_kit.rules) - 2017178 - ET EXPLOIT DRIVEBY Rawin - Java Exploit -dubspace.jar (exploit.rules) - 2017187 - ET CURRENT\_EVENTS c0896 Hacked Site Response (Outbound) 1 (current\_events.rules) - 2017188 - ET CURRENT\_EVENTS c0896 Hacked Site Response (Outbound) 2 (current\_events.rules) - 2017189 - ET CURRENT\_EVENTS c0896 Hacked Site Response (Outbound) 3 (current\_events.rules) - 2017191 - ET MALWARE Win32/Kelihos.F Checkin (malware.rules) - 2017192 - ET CURRENT\_EVENTS c0896 Hacked Site Response Octal (Outbound) (current\_events.rules) - 2017246 - ET CURRENT\_EVENTS c0896 Hacked Site Response (Outbound) 4 (current\_events.rules) - 2017248 - ET EXPLOIT\_KIT PluginDetect plus Java version check (exploit\_kit.rules) - 2017250 - ET EXPLOIT\_KIT %Hex Encoded jnlp\_embedded (Observed in Sakura) (exploit\_kit.rules) - 2017251 - ET EXPLOIT\_KIT %Hex Encoded applet\_ssv\_validated (Observed in Sakura) (exploit\_kit.rules) - 2017252 - ET EXPLOIT\_KIT %Hex Encoded/base64 1 applet\_ssv\_validated (Observed in Sakura) (exploit\_kit.rules) - 2017253 - ET EXPLOIT\_KIT %Hex Encoded/base64 2 applet\_ssv\_validated (Observed in Sakura) (exploit\_kit.rules) - 2017254 - ET EXPLOIT\_KIT %Hex Encoded/base64 3 applet\_ssv\_validated (Observed in Sakura) (exploit\_kit.rules) - 2017257 - ET CURRENT\_EVENTS Fake FedEX/Pony spam campaign URI Struct 2 (current\_events.rules) - 2017263 - ET MALWARE StealRat Checkin (malware.rules) - 2017270 - ET EXPLOIT\_KIT Styx Exploit Kit Landing Applet With Payload Aug 02 2013 (exploit\_kit.rules) - 2017271 - ET EXPLOIT\_KIT Plugin-Detect with global % replace on unescaped string (Sakura) (exploit\_kit.rules) - 2017274 - ET MALWARE W32/StealRat.SpamBot Configuration File Request (malware.rules) - 2017275 - ET MALWARE W32/StealRat.SpamBot CnC Server Configuration File Response (malware.rules) - 2017295 - ET EXPLOIT\_KIT Styx iframe with obfuscated Java version check Jul 04 2013 (exploit\_kit.rules) - 2017300 - ET EXPLOIT\_KIT Rawin -TDS - POST w/Java Version (exploit\_kit.rules) - 2017301 - ET WEB\_CLIENT Fake Trojan Dropper purporting to be missing application page landing (web\_client.rules) - 2017302 - ET CURRENT\_EVENTS Fake Trojan Dropper purporting to be missing application - findloader (current\_events.rules) - 2017306 - ET CURRENT\_EVENTS 0f2490 Hacked Site Response (Inbound) (current\_events.rules) - 2017307 - ET CURRENT\_EVENTS 0f2490 Hacked Site Response (Outbound) (current\_events.rules) - 2017324 - ET EXPLOIT\_KIT FlimKit obfuscated hex-encoded jnlp\_embedded Aug 08 2013 (exploit\_kit.rules) - 2017366 - ET WEB\_SERVER Coldfusion 9 Auth Bypass CVE-2013-0632 (web\_server.rules) - 2017370 - ET CURRENT\_EVENTS AutoIT C&C Check-In 2013-08-23 URL (current\_events.rules) - 2017371 - ET MALWARE Win32/Neurevt.A/Betabot checkin (malware.rules) - 2017372 - ET EXPLOIT\_KIT Sweet Orange Landing with Applet Aug 26 2013 (exploit\_kit.rules) - 2017378 - ET MALWARE Drive DDoS Tool get command received key=okokokjjk (malware.rules) - 2017379 - ET MALWARE Drive DDoS Tool long command received key=okokokjjk (malware.rules) - 2017380 - ET MALWARE Drive DDoS Tool smart command received key=okokokjjk (malware.rules) - 2017381 - ET MALWARE Drive DDoS Tool post1 command received key=okokokjjk (malware.rules) - 2017382 - ET MALWARE Drive DDoS Tool post2 command received key=okokokjjk (malware.rules) - 2017383 - ET MALWARE Drive DDoS Tool byte command received key=okokokjjk (malware.rules) - 2017384 - ET MALWARE Drive DDoS Tool byte command received key=okokokjjk (malware.rules) - 2017405 - ET EXPLOIT\_KIT Sweet Orange Landing with Applet Aug 30 2013 (exploit\_kit.rules) - 2017408 - ET EXPLOIT\_KIT GondadEK Landing Sept 03 2013 (exploit\_kit.rules) - 2017412 - ET MALWARE Gh0st\_Apple Checkin (malware.rules) - 2017450 - ET CURRENT\_EVENTS Sakura Sep 10 2013 (current\_events.rules) - 2017451 - ET EXPLOIT\_KIT FlimKit Landing Page (exploit\_kit.rules) - 2017453 - ET WEB\_CLIENT DRIVEBY Redirection - Forum Injection (web\_client.rules) - 2017474 - ET EXPLOIT\_KIT CoolEK Variant Landing Page - Applet Sep 16 2013 (exploit\_kit.rules) - 2017506 - ET EXPLOIT Sakura - Java Exploit Recieved - Atomic (exploit.rules) - 2017507 - ET WEB\_CLIENT Cushion Redirection (web\_client.rules) - 2017510 - ET EXPLOIT Metasploit Exploit Specific Function Naming (exploit.rules) - 2017513 - ET WEB\_CLIENT W32/Caphaw DriveBy Campaign Ping.html (web\_client.rules) - 2017518 - ET MALWARE Worm.VBS.ayr CnC command (/iam-ready) (malware.rules) - 2017523 - ET MALWARE Worm.VBS.ayr CnC command response (malware.rules) - 2017547 - ET EXPLOIT\_KIT CoolEK Jar Download Sep 30 2013 (exploit\_kit.rules) - 2017549 - ET WEB\_CLIENT Fake MS Security Update (Jar) (web\_client.rules) - 2017551 - ET EXPLOIT\_KIT Obfuscated http 2 digit sep in applet (Seen in HiMan EK) (exploit\_kit.rules) - 2017559 - ET MALWARE SSH Connection on 443 - Mevade Banner (malware.rules) - 2017567 - ET EXPLOIT\_KIT FiestaEK js-redirect (exploit\_kit.rules) - 2017580 - ET CURRENT\_EVENTS DotkaChef Payload October 09 (current\_events.rules) - 2017590 - ET CURRENT\_EVENTS D-LINK Router Backdoor via Specific UA (current\_events.rules) - 2017623 - ET CURRENT\_EVENTS Tenda Router Backdoor 1 (current\_events.rules) - 2017624 - ET CURRENT\_EVENTS Tenda Router Backdoor 2 (current\_events.rules) - 2017625 - ET CURRENT\_EVENTS 81a338 Hacked Site Response (Outbound) (current\_events.rules) - 2017626 - ET CURRENT\_EVENTS 81a338 Hacked Site Response (Inbound) (current\_events.rules) - 2017629 - ET CURRENT\_EVENTS FlashPack Oct 23 2013 (current\_events.rules) - 2017631 - ET CURRENT\_EVENTS Netgear WNDR4700 Auth Bypass (current\_events.rules) - 2017632 - ET CURRENT\_EVENTS Netgear WNDR3700 Auth Bypass (current\_events.rules) - 2017634 - ET EXPLOIT\_KIT Sweet Orange Landing Page Oct 25 2013 (exploit\_kit.rules) - 2017638 - ET CURRENT\_EVENTS Alpha Networks ADSL2/2+ router remote administration password disclosure (current\_events.rules) - 2017642 - ET MALWARE Linux/Ssemgrvd sshd Backdoor HTTP CNC 1 (malware.rules) - 2017644 - ET CURRENT\_EVENTS Host Domain .bit (current\_events.rules) - 2017649 - ET EXPLOIT\_KIT Sweet Orange encrypted payload (exploit\_kit.rules) - 2017650 - ET EXPLOIT\_KIT SofosFO/Grandsoft Plugin-Detect (exploit\_kit.rules) - 2017660 - ET WEB\_CLIENT Malicious Cookie Set By Flash Malvertising (web\_client.rules) - 2017663 - ET EXPLOIT Fredcot campaign php5-cgi initial exploit (exploit.rules) - 2017664 - ET MALWARE Fredcot campaign payload download (malware.rules) - 2017665 - ET CURRENT\_EVENTS Fredcot campaign IRC CnC (current\_events.rules) - 2017693 - ET EXPLOIT\_KIT Styx iframe with obfuscated CVE-2013-2551 (exploit\_kit.rules) - 2017696 - ET WEB\_CLIENT FaceBook IM & Web Driven Facebook Trojan Download (web\_client.rules) - 2017698 - ET WEB\_CLIENT Magnitude Landing Nov 11 2013 (web\_client.rules) - 2017712 - ET EXPLOIT Microsoft Outlook/Crypto API X.509 oid id-pe-authorityInfoAccessSyntax design bug allow blind HTTP requests attempt (exploit.rules) - 2017713 - ET MALWARE Taidoor Checkin (malware.rules) - 2017718 - ET MALWARE Trojan.BlackRev Botnet Login Request CnC Beacon (malware.rules) - 2017740 - ET EXPLOIT\_KIT Sweet Orange Landing Page Nov 21 2013 (exploit\_kit.rules) - 2017745 - ET CURRENT\_EVENTS Fake Media Player malware binary requested (current\_events.rules) - 2017747 - ET MALWARE Trojan-Downloader Win32.Genome.AV server response (malware.rules) - 2017791 - ET CURRENT\_EVENTS Polling/Check-in/Compromise from fake DHL mailing campaign (current\_events.rules) - 2017792 - ET CURRENT\_EVENTS Hostile fake DHL mailing campaign (current\_events.rules) - 2017813 - ET CURRENT\_EVENTS Safe/CritX/FlashPack Payload (current\_events.rules) - 2017823 - ET EXPLOIT\_KIT heapSpray in jjencode (exploit\_kit.rules) - 2017840 - ET EXPLOIT\_KIT Styx Exploit Kit - JAR Exploit (exploit\_kit.rules) - 2017844 - ET EXPLOIT\_KIT Styx Exploit Kit - EOT Exploit (exploit\_kit.rules) - 2017846 - ET WEB\_CLIENT DRIVEBY FakeUpdate - URI - Payload Requested (web\_client.rules) - 2017847 - ET WEB\_CLIENT Browlock Landing Page URI Struct (web\_client.rules) - 2017862 - ET EXPLOIT\_KIT CrimePack PDF Exploit (exploit\_kit.rules) - 2017863 - ET EXPLOIT\_KIT CrimePack Java Exploit (exploit\_kit.rules) - 2017864 - ET EXPLOIT\_KIT CrimePack HCP Exploit (exploit\_kit.rules) - 2017865 - ET EXPLOIT\_KIT CrimePack Jar 1 Dec 16 2013 (exploit\_kit.rules) - 2017866 - ET EXPLOIT\_KIT CrimePack Jar 2 Dec 16 2013 (exploit\_kit.rules) - 2017869 - ET MALWARE W32/Liftoh.Downloader Final.html Payload Request (malware.rules) - 2017882 - ET WEB\_SERVER Apache Solr Arbitrary XSLT inclusion attack (CVE-2013-6397) (web\_server.rules) - 2017893 - ET EXPLOIT\_KIT DotkaChef Landing URI Struct (exploit\_kit.rules) - 2017894 - ET EXPLOIT\_KIT DotkaChef Payload Dec 20 2013 (exploit\_kit.rules) - 2017903 - ET MALWARE Win32/Urausy.C Checkin 4 (malware.rules) - 2017905 - ET CURRENT\_EVENTS SofosFO/GrandSoft PDF (current\_events.rules) - 2017907 - ET EXPLOIT\_KIT GoonEK Landing with CVE-2013-2551 Dec 29 2013 (exploit\_kit.rules) - 2018763 - ET MALWARE Win.Trojan.Agent-29225 Checkin (malware.rules) - 2018958 - ET MALWARE Worm.Win32.Vobfus Checkin 3 (malware.rules) - 2030249 - ET WEB\_CLIENT Cushion Redirection (web\_client.rules) - 2805864 - ETPRO MOBILE\_MALWARE Android/Adware.BatteryDoctor.F Checkin (mobile\_malware.rules) - 2805871 - ETPRO MALWARE Trojan-Downloader.Win32.Delf Checkin (malware.rules) - 2805879 - ETPRO MALWARE W32/Koobface.hcy CnC response (malware.rules) - 2805892 - ETPRO WEB\_CLIENT Adobe PDF file with Hybrid file at header (web\_client.rules) - 2805905 - ETPRO MALWARE Hupigon Checkin to ip.txt Received (malware.rules) - 2805909 - ETPRO ADWARE\_PUP drspyzero Checkin (adware\_pup.rules) - 2805914 - ETPRO MALWARE TrojanDownloader.Win32/Pluzoks.A CnC response (malware.rules) - 2805919 - ETPRO MALWARE CryptoWall Check-in M3 (malware.rules) - 2805922 - ETPRO MOBILE\_MALWARE Monitor.AndroidOS.Biige.a Checkin (mobile\_malware.rules) - 2805952 - ETPRO MALWARE Win32/AgentBypass.B CnC - SET (malware.rules) - 2805953 - ETPRO MALWARE Win32/AgentBypass.B CnC - Download exe command (malware.rules) - 2805967 - ETPRO MALWARE Trojan.Larhife.A reporting via ICQ WWW script (malware.rules) - 2805988 - ETPRO MALWARE Trojan-Spy.Win32.KeyLogger.acqh Checkin (malware.rules) - 2805989 - ETPRO MOBILE\_MALWARE Backdoor.AndroidOS.Fakengry.b Checkin 3 (mobile\_malware.rules) - 2805996 - ETPRO MALWARE Trojan-PWS.Banker6 sending info via SMTP (malware.rules) - 2805997 - ETPRO MOBILE\_MALWARE Monitoring-Tool.Android/Trackplus.A Checkin (mobile\_malware.rules) - 2806001 - ETPRO MALWARE Win32/Tepv.A CnC Credentials Returned (malware.rules) - 2806016 - ETPRO WEB\_CLIENT DirectShow MPEG Buffer Overlflow CVE-2013-0077 (web\_client.rules) - 2806029 - ETPRO EXPLOIT ADOBE PDF zeroday 14 February (exploit.rules) - 2806047 - ETPRO ADWARE\_PUP Win32/Adware.Kraddare.CX Checkin (adware\_pup.rules) - 2806051 - ETPRO ADWARE\_PUP Adware.Statblaster.T Checkin (adware\_pup.rules) - 2806053 - ETPRO ADWARE\_PUP ADWARE/InstallCore.Gen Checkin (adware\_pup.rules) - 2806076 - ETPRO MALWARE Win32/Carberp.A Checkin 3 (malware.rules) - 2806097 - ETPRO MALWARE Sinowal/Torpig checkin (malware.rules) - 2806104 - ETPRO MALWARE TROJ\_AGENT.EVF checkin (malware.rules) - 2806121 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.MTK.a Checkin (mobile\_malware.rules) - 2806152 - ETPRO MALWARE TeamSpy Campaign module download (malware.rules) - 2806159 - ETPRO MOBILE\_MALWARE AndroidOS\_Adrd.VTD Checkin 2 (mobile\_malware.rules) - 2806164 - ETPRO MALWARE TrojanDownloader Win32/Unruy.C Checkin 2 (malware.rules) - 2806170 - ETPRO ADWARE\_PUP file sharing service [software112.com](http://software112.com) installer download (adware\_pup.rules) - 2806190 - ETPRO MALWARE Cridex dll download - SET (malware.rules) - 2806191 - ETPRO MALWARE Cridex dll download (malware.rules) - 2806199 - ETPRO ADWARE\_PUP Win32/Cinmus.N Checkin (adware\_pup.rules) - 2806208 - ETPRO MOBILE\_MALWARE Android.Uracto Checkin (mobile\_malware.rules) - 2806234 - ETPRO WEB\_CLIENT Windows Live Essentials Insecure URI Handler (CVE-2013-0096) (web\_client.rules) - 2806235 - ETPRO MALWARE Trojan-Ransom.Win32.Blocker.avsx Checkin (malware.rules) - 2806244 - ETPRO MALWARE W32/IRCBot-based!Maximus (malware.rules) - 2806259 - ETPRO MOBILE\_MALWARE Android/Joye.A Checkin (mobile\_malware.rules) - 2806305 - ETPRO MALWARE Trojan-PSW.Reedum FTP login (malware.rules) - 2806306 - ETPRO MALWARE Trojan-PSW.Reedum FTP long Port (LPRT) (malware.rules) - 2806307 - ETPRO MALWARE Win32/Depyot.B Checkin (malware.rules) - 2806308 - ETPRO MOBILE\_MALWARE Trojan-SMS.AndroidOS.FakeInst.a Checkin (mobile\_malware.rules) - 2806312 - ETPRO MALWARE Win32/Spy.Bancos.OUH Checkin (malware.rules) - 2806324 - ETPRO ADWARE\_PUP Trojan-Downloader.Win32.Agent.gzfw Checkin (adware\_pup.rules) - 2806330 - ETPRO MOBILE\_MALWARE Spy.AndroidOS.Zitmo.a Checkin (mobile\_malware.rules) - 2806342 - ETPRO MALWARE Win32.ShipUp.boz Download (malware.rules) - 2806355 - ETPRO WEB\_CLIENT Microsoft Internet Explorer cross-domain JSON file content disclosure (web\_client.rules) - 2806397 - ETPRO MALWARE W32/Banker.EIQTNXK!tr.spy Checkin (malware.rules) - 2806423 - ETPRO MALWARE Variant.zbot Server Response (malware.rules) - 2806441 - ETPRO MALWARE Variant.Zusy.43699 Checkin (malware.rules) - 2806448 - ETPRO MALWARE Win32/Autoit.IT Checkin 2 (malware.rules) - 2806485 - ETPRO WEB\_CLIENT Internet Explorer Double Free (CVE-2013-3118) (web\_client.rules) - 2806489 - ETPRO WEB\_CLIENT Internet Explorer onscroll (CVE-2013-3123) (web\_client.rules) - 2806490 - ETPRO WEB\_CLIENT Internet Explorer onscroll CVE-2013-3123 (web\_client.rules) - 2806502 - ETPRO MALWARE Win32.Jorik.Agent.ppv GET (malware.rules) - 2806503 - ETPRO MALWARE Win32/Injector.Autoit.P Checkin (malware.rules) - 2806507 - ETPRO MALWARE Win32/Injector.Autoit.P variant response (malware.rules) - 2806509 - ETPRO MALWARE Backdoor.Win32.SdBot.baa CnC at IRC Channel (malware.rules) - 2806530 - ETPRO MALWARE Win32.PoniPatcher.A .exe Download (malware.rules) - 2806566 - ETPRO MALWARE Win32/C2Lop.B Download (malware.rules) - 2806591 - ETPRO MALWARE Deka Infostealer FTP upload (malware.rules) - 2806593 - ETPRO MALWARE AndroidOS.UsbCleaver Zip Download (malware.rules) - 2806613 - ETPRO MALWARE Trojan.Win32.Pincav.cngr Checkin 2 (malware.rules) - 2806657 - ETPRO MALWARE Win32.CCProxy.jk (proxy redirect) (malware.rules) - 2806667 - ETPRO MALWARE Win32.Jorik.Agent.mi 2 (malware.rules) - 2806706 - ETPRO MALWARE Worm.Win32.Luder spreading via SMTP (malware.rules) - 2806709 - ETPRO ADWARE\_PUP Server-Web.Win32.NetBox.c Checkin (adware\_pup.rules) - 2806737 - ETPRO MALWARE Trojan-Proxy.Win32.Small.ez Checkin (malware.rules) - 2806751 - ETPRO MOBILE\_MALWARE Android.Troj.at\_m933.b Checkin (mobile\_malware.rules) - 2806756 - ETPRO MALWARE Trojan.Win32.Agentb.jwp Checkin (malware.rules) - 2806759 - ETPRO MALWARE Virus.Win32.Kate.a .exe Request (malware.rules) - 2806761 - ETPRO MALWARE Worm.Win32.Luder.wja spreading via SMTP 2 (malware.rules) - 2806770 - ETPRO MALWARE BScope.Trojan.Banker Checkin 2 (malware.rules) - 2806789 - ETPRO MALWARE Livesearchnow browser hijack 1 (malware.rules) - 2806804 - ETPRO MALWARE Rodecap CnC response 5 (malware.rules) - 2806805 - ETPRO MALWARE Rodecap CnC response 6 (malware.rules) - 2806812 - ETPRO MOBILE\_MALWARE Android/SMSstealer.A!tr Checkin (mobile\_malware.rules) - 2806822 - ETPRO WEB\_SERVER ADFS Service Account Leak CVE-2013-3185 (web\_server.rules) - 2806829 - ETPRO MOBILE\_MALWARE Trojan-Downloader.AndroidOS.Fav.a Checkin (mobile\_malware.rules) - 2806835 - ETPRO MALWARE Trojan-Dropper.Win32.Injector.iucz Checkin 2 (malware.rules) - 2806836 - ETPRO MALWARE zbot-variant fetching instagram data to send spam (malware.rules) - 2806846 - ETPRO MALWARE Stealer sending stolen data via SMTP (malware.rules) - 2806856 - ETPRO MALWARE Backdoor.MeSub.ey CnC Response (malware.rules) - 2806876 - ETPRO MALWARE Optix Pro RAT connection acknowledgement (malware.rules) - 2806877 - ETPRO MOBILE\_MALWARE Android/TheftSpy.C Checkin (mobile\_malware.rules) - 2806891 - ETPRO ADWARE\_PUP Downloader/Win32.Adload Checkin (adware\_pup.rules) - 2806897 - ETPRO MALWARE Worm.Dabber.B Checkin (malware.rules) - 2806899 - ETPRO MALWARE Win32.Otlard.A C&C communications end 2 (malware.rules) - 2806900 - ETPRO MALWARE Win32.Otlard.A C&C communications end 3 (malware.rules) - 2806901 - ETPRO MALWARE Win32.Otlard.A C&C checkin (malware.rules) - 2806902 - ETPRO MALWARE Win32.Otlard.A C&C Checkin response (malware.rules) - 2806907 - ETPRO ADWARE\_PUP mozila POST (adware\_pup.rules) - 2806920 - ETPRO MALWARE Trojan.Rontokbro Checkin (malware.rules) - 2806928 - ETPRO MALWARE Win32.Qhost.ahyc Checkin (malware.rules) - 2806970 - ETPRO WEB\_SERVER Microsoft SharePoint DoS 1 CVE-2013-0081 (web\_server.rules) - 2806971 - ETPRO WEB\_SERVER Microsoft SharePoint DoS 2 CVE-2013-0081 (web\_server.rules) - 2806972 - ETPRO WEB\_SERVER Microsoft SharePoint XSS attempt (CVE-2013-3180) (web\_server.rules) - 2806996 - ETPRO MALWARE Win32/Agent.PVY Checkin (malware.rules) - 2807011 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.SmForw.u Checkin (mobile\_malware.rules) - 2807014 - ETPRO MOBILE\_MALWARE Trojan-SMS.AndroidOS.FakeInst.eh Checkin (mobile\_malware.rules) - 2807027 - ETPRO MALWARE Win32/Meredrop Checkin (malware.rules) - 2807030 - ETPRO MALWARE TrojanDropper.Agent.axkq Response 1 (malware.rules) - 2807031 - ETPRO MALWARE TrojanDropper.Agent.axkq Response 2 (malware.rules) - 2807040 - ETPRO MOBILE\_MALWARE Andr/DroidRt-A Checkin (mobile\_malware.rules) - 2807047 - ETPRO MALWARE Backdoor.Win32.GF.13x.A Response (malware.rules) - 2807056 - ETPRO MALWARE Win32.Kryptik.BJWG 1 (malware.rules) - 2807057 - ETPRO MALWARE Win32.Kryptik.BJWG 2 (malware.rules) - 2807058 - ETPRO MALWARE Win32.Kryptik.BJWG 3 (malware.rules) - 2807059 - ETPRO MALWARE Win32.Kryptik.BJWG 4 (malware.rules) - 2807060 - ETPRO MALWARE Win32.Kryptik.BJWG 5 (malware.rules) - 2807061 - ETPRO MALWARE Win32/Rbot SSL checkin 1 (malware.rules) - 2807062 - ETPRO MALWARE Win32/Rbot SSL checkin 2 (malware.rules) - 2807063 - ETPRO MALWARE Win32/Rbot SSL checkin 4 (malware.rules) - 2807064 - ETPRO MALWARE Win32/Rbot SSL checkin 5 (malware.rules) - 2807065 - ETPRO MALWARE Win32/Rbot SSL checkin 6 (malware.rules) - 2807066 - ETPRO MALWARE Win32/Rbot SSL checkin 7 (malware.rules) - 2807067 - ETPRO MALWARE Win32/Rbot SSL checkin 8 (malware.rules) - 2807068 - ETPRO MALWARE Win32/Rbot SSL checkin 9 (malware.rules) - 2807080 - ETPRO MALWARE Icefog sending stolen data via SMTP (malware.rules) - 2807084 - ETPRO WEB\_CLIENT Latest Internet Explorer 0day used against Taiwan targets exe download (web\_client.rules) - 2807107 - ETPRO WEB\_SERVER Microsoft SharePoint XSS attempt (CVE-2013-3895) (web\_server.rules) - 2807108 - ETPRO MALWARE Trojan-Banker.Win32.Banbra.aztd Response (malware.rules) - 2807109 - ETPRO MALWARE RemoteAdmin.Win32.Minicom.38 Broadcasting (malware.rules) - 2807116 - ETPRO MALWARE TrojanDropper.Agent.axkq Response 3 (malware.rules) - 2807119 - ETPRO MALWARE Downloader/Win32.Zlob Checkin (malware.rules) - 2807122 - ETPRO MALWARE Win32/Spy.Delf.PHC Checkin (malware.rules) - 2807123 - ETPRO MALWARE Win32/Spy.Delf.PHC Checkin 2 (malware.rules) - 2807143 - ETPRO MALWARE Win32.RatTool Checkin (malware.rules) - 2807148 - ETPRO MALWARE Win32/Spy.Bancos.OGH Checkin (malware.rules) - 2807150 - ETPRO ADWARE\_PUP Security Cleaner Pro FakeAV Checkin (adware\_pup.rules) - 2807154 - ETPRO MALWARE Win32/Gapz CnC (malware.rules) - 2807155 - ETPRO MALWARE Win32/Spy.Banker.YSS sending data via SMTP (malware.rules) - 2807158 - ETPRO MALWARE Trojan-Ransom.Win32.Blocker.brxp Download (malware.rules) - 2807163 - ETPRO ADWARE\_PUP Adware/AccesMembre Checkin M1 (adware\_pup.rules) - 2807181 - ETPRO MALWARE Win32/IRCbot.gen!AC Reporting via IRC (malware.rules) - 2807193 - ETPRO MALWARE Trojan-Ransom.Win32.Foreign.jcov Checkin (malware.rules) - 2807194 - ETPRO MALWARE Win32/Stoberox Checkin (malware.rules) - 2807221 - ETPRO MALWARE Win32/Spy.Bancos.OUF Checkin via SMTP (malware.rules) - 2807226 - ETPRO MALWARE Win32/Banker.AU Checkin (malware.rules) - 2807237 - ETPRO WEB\_CLIENT Adobe PDF file corrupted download (CVE-2013-3355) 1 (web\_client.rules) - 2807238 - ETPRO WEB\_CLIENT Adobe PDF file corrupted download (CVE-2013-3355) 2 (web\_client.rules) - 2807239 - ETPRO WEB\_CLIENT Adobe PDF file corrupted download (CVE-2013-3351) 1 (web\_client.rules) - 2807240 - ETPRO WEB\_CLIENT Adobe PDF file corrupted download (CVE-2013-3351) 2 (web\_client.rules) - 2807247 - ETPRO MALWARE Splinter RAT Download (malware.rules) - 2807248 - ETPRO MALWARE Splinter RAT Client Reporting (malware.rules) - 2807249 - ETPRO MALWARE Splinter RAT Server To Client Coms (malware.rules) - 2807255 - ETPRO MALWARE Trojan.Win32.Buzus.fcjf Checkin (malware.rules) - 2807271 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.SmForw.m Checkin (mobile\_malware.rules) - 2807287 - ETPRO MALWARE Trojan-Dropper.Win32.Agent.iish Checkin (malware.rules) - 2807298 - ETPRO WEB\_CLIENT IE noembed user after free (CVE-2013-5049) (web\_client.rules) - 2807308 - ETPRO MALWARE Trojan.Click2.50106 Checkin (malware.rules) - 2807311 - ETPRO MALWARE Variant.Kazy.277370 Checkin (malware.rules) - 2807326 - ETPRO MALWARE Trojan-Downloader.Win32.Genome.atap Checkin (malware.rules) - 2807334 - ETPRO ADWARE\_PUP Win32/Adware.VrBrothers.AA Checkin (adware\_pup.rules) - 2807337 - ETPRO ADWARE\_PUP Adware.Agent.NRL Checkin (adware\_pup.rules) - 2807346 - ETPRO MALWARE Backdoor/Poison.evja Checkin (malware.rules) - 2807372 - ETPRO MALWARE Win32/Dapato.L Requesting Data via MSSQL Off-Port (malware.rules) - 2807412 - ETPRO ADWARE\_PUP Win32/Wysotot.A Checkin (adware\_pup.rules)