Ruleset Update Summary - 2026/09/11 - v11288

Ruleset Updates
1

Summary:

22 new OPEN, 44 new PRO (22 + 22)

Added rules:

Open:

  • 2071996 - ET MALWARE GemStone Gemini Chrome Extension CnC - Register (malware.rules)
  • 2071997 - ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat (malware.rules)
  • 2071998 - ET MALWARE GemStone Gemini Chrome Extension CnC - Ingest (malware.rules)
  • 2071999 - ET MALWARE GemStone Gemini Chrome Extension CnC - Screenshots (malware.rules)
  • 2072000 - ET MALWARE GemStone Gemini Chrome Extension CnC - Poll Commands (malware.rules)
  • 2072001 - ET MALWARE GemStone Gemini Chrome Extension CnC - Command Results (malware.rules)
  • 2072002 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (roeerts .cfd) (exploit_kit.rules)
  • 2072003 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (aatthews .cfd) (exploit_kit.rules)
  • 2072004 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (hodkiewhcz .sbs) (exploit_kit.rules)
  • 2072005 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (kusikowski .sbs) (exploit_kit.rules)
  • 2072006 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (roeerts .cfd) (exploit_kit.rules)
  • 2072007 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (aatthews .cfd) (exploit_kit.rules)
  • 2072008 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (hodkiewhcz .sbs) (exploit_kit.rules)
  • 2072009 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (kusikowski .sbs) (exploit_kit.rules)
  • 2072010 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (gws-api .snus-grossiste .com) (malware.rules)
  • 2072011 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (redhat .psychedelicshome .live) (malware.rules)
  • 2072012 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (gws-api .snus-grossiste .com) (malware.rules)
  • 2072013 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (redhat .psychedelicshome .live) (malware.rules)
  • 2072014 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tritonbody .fun) (malware.rules)
  • 2072015 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tritonbody .fun) in TLS SNI (malware.rules)
  • 2072016 - ET EXPLOIT WAVLINK Sync Server Command Injection/Arbitrary File Write Attempt (CVE-2026-89010, CVE-2026-89009) (exploit.rules)
  • 2072017 - ET HUNTING GET to ip .ipify .org via WinHTTP (hunting.rules)

Pro:

  • 2868541 - ETPRO MALWARE Observed DNS Query to Malicious Domain (malware.rules)
  • 2868542 - ETPRO MALWARE Observed DNS Query to Malicious Domain (malware.rules)
  • 2868543 - ETPRO MALWARE Observed Malicious Domain in TLS SNI (malware.rules)
  • 2868544 - ETPRO MALWARE Observed Malicious Domain in TLS SNI (malware.rules)
  • 2868545 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868546 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868547 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868548 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868549 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868550 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868551 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868552 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868553 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868554 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868555 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868556 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868557 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868558 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868559 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868560 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868561 - ETPRO ATTACK_RESPONSE Ransomware Attack Chain .bat Inbound (attack_response.rules)
  • 2868562 - ETPRO MALWARE MatrixHyper CnC Response (File Not Found) (malware.rules)

Modified inactive rules:

  • 2867843 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2867857 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)