Ruleset Update Summary - 2026/09/10 - v11287

Ruleset Updates
1

Summary:

13 new OPEN, 46 new PRO (13 + 33)

Added rules:

Open:

  • 2012064 - ET RETIRED Foxit PDF Reader Title Stack Overflow (retired.rules)
  • 2071984 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (regions .globalcargonetwork .com) (malware.rules)
  • 2071985 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (regions .globalcargonetwork .com) (malware.rules)
  • 2071986 - ET WEB_SPECIFIC_APPS Sangoma Switchvox PhoneIP Parameter SQL Injection Attempt (CVE-2026-9586) (web_specific_apps.rules)
  • 2071987 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (taretool .pw) (malware.rules)
  • 2071988 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (taretool .pw) in TLS SNI (malware.rules)
  • 2071989 - ET EXPLOIT_KIT Darksword iOS EK Landing Page (exploit_kit.rules)
  • 2071990 - ET MALWARE Cobalt Strike CnC Beacon (GET) (malware.rules)
  • 2071991 - ET EXPLOIT_KIT Darksword iOS EK RCE Loader Page (exploit_kit.rules)
  • 2071992 - ET EXPLOIT_KIT Darksword iOS EK RCE Worker Page (exploit_kit.rules)
  • 2071993 - ET EXPLOIT_KIT Darksword iOS EK RCE Module Page (exploit_kit.rules)
  • 2071994 - ET MALWARE Cobalt Strike Beacon Beacon Domain in DNS Lookup (employeenotifierdevice-cha9g0g9g4hebmea .z02 .azurefd .net) (malware.rules)
  • 2071995 - ET MALWARE Observed Cobalt Strike Beacon Domain (employeenotifierdevice-cha9g0g9g4hebmea .z02 .azurefd .net in TLS SNI) (malware.rules)

Pro:

  • 2868508 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868509 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868510 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868511 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868512 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868513 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868514 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868515 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868516 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868517 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868518 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868519 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868520 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868521 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868522 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868523 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868524 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868525 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868526 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868527 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868528 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868529 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868530 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868531 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868532 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868533 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868534 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868535 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868536 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868537 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868538 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868539 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868540 - ETPRO MALWARE Amatera Stealer CnC Exfil (POST) M5 (malware.rules)

Removed rules:

  • 2012064 - ET WEB_CLIENT Foxit PDF Reader Title Stack Overflow (web_client.rules)