Ruleset Update Summary - 2026/09/09 - v11286

Ruleset Updates
1

Summary:

6 new OPEN, 15 new PRO (6 + 9)

Added rules:

Open:

  • 2071978 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (claimpassivedebatw .pw) (malware.rules)
  • 2071979 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (claimpassivedebatw .pw) in TLS SNI (malware.rules)
  • 2071980 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (coldcoercekowja .fun) (malware.rules)
  • 2071981 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (coldcoercekowja .fun) in TLS SNI (malware.rules)
  • 2071982 - ET WEB_SPECIFIC_APPS D-Link file_sharing.cgi fileurl Parameter Command Injection Attempt (CVE-2026-85224) (web_specific_apps.rules)
  • 2071983 - ET WEB_SPECIFIC_APPS D-Link dropbox.cgi Multiple Parameters Command Injection Attempt (CVE-2026-85223) (web_specific_apps.rules)

Pro:

  • 2868499 - ETPRO EXPLOIT_KIT Observed DNS Query to ClickFix Domain (exploit_kit.rules)
  • 2868500 - ETPRO EXPLOIT_KIT Observed ClickFix Domain in TLS SNI (exploit_kit.rules)
  • 2868501 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M1 (malware.rules)
  • 2868502 - ETPRO MALWARE PowerShell Loader Payload Request For Xord Data (malware.rules)
  • 2868503 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M2 (malware.rules)
  • 2868504 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M3 (malware.rules)
  • 2868505 - ETPRO MALWARE PowerShell Loader Request For Encrypted Payload (malware.rules)
  • 2868506 - ETPRO HUNTING JavaScript Object Confusion via addrof/fakeobj Primitives (hunting.rules)
  • 2868507 - ETPRO HUNTING WebAssembly Exception/Table Type Confusion (Opcodes) (hunting.rules)

Modified inactive rules:

  • 2867859 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)