Ruleset Update Summary - 2026/09/14 - v11289

Ruleset Updates
1

Summary:

20 new OPEN, 73 new PRO (20 + 53)

Added rules:

Open:

  • 2072018 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (simesmile .xyz) (malware.rules)
  • 2072019 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (simesmile .xyz) in TLS SNI (malware.rules)
  • 2072020 - ET MALWARE Win32/DarkCloud Exfil Over SMTP (Agent) (malware.rules)
  • 2072021 - ET MALWARE 10FXRAT C2 Beacon (Initial) (malware.rules)
  • 2072022 - ET MALWARE 10FXRAT C2 Beacon (Heartbeat) (malware.rules)
  • 2072023 - ET MALWARE 10FXRAT C2 Beacon (Shell Results) (malware.rules)
  • 2072024 - ET MALWARE 10FXRAT C2 Beacon (Compressed Data) (malware.rules)
  • 2072025 - ET MALWARE 10FXRAT C2 Beacon (Task Results) (malware.rules)
  • 2072026 - ET MALWARE 10FXRAT C2 Beacon (Plugin) Request (malware.rules)
  • 2072027 - ET MALWARE 10FXRAT C2 Beacon (SOCKS5) Request (malware.rules)
  • 2072028 - ET MALWARE 10FXRAT C2 Beacon (Heartbeat) Response (malware.rules)
  • 2072029 - ET MALWARE 10FXRAT C2 Beacon (Shell Execution) Response (malware.rules)
  • 2072030 - ET MALWARE 10FXRAT C2 Beacon (Emulate) Response (malware.rules)
  • 2072031 - ET MALWARE 10FXRAT C2 Beacon (Task Execution) Response (malware.rules)
  • 2072032 - ET MALWARE 10FXRAT C2 Beacon (Plugin) Response (malware.rules)
  • 2072033 - ET MALWARE 10FXRAT C2 Beacon (SOCKS5) Response (malware.rules)
  • 2072034 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (pa-portal .gloshex .com) (malware.rules)
  • 2072035 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (pa-portal .gloshex .com) (malware.rules)
  • 2072036 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (regendj .cyou) (malware.rules)
  • 2072037 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (regendj .cyou) in TLS SNI (malware.rules)

Pro:

  • 2868563 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868564 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868565 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868566 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868567 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868568 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868569 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868570 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868571 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868572 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868573 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868574 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868575 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868576 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868577 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868578 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868579 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868580 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868581 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868582 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868583 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868584 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868585 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868586 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868587 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868588 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868589 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868590 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868591 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868592 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868593 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868594 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868595 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868596 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868597 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868598 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868599 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868600 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868601 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868602 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868603 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868604 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868605 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868606 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868607 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868608 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868609 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868610 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868611 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868612 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868613 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868614 - ETPRO USER_AGENTS Suspicious UA Observed in Nefarious Cases (user_agents.rules)
  • 2868615 - ETPRO EXPLOIT TP-Link VIGI C385 Authenticated Remote Code Execution (CVE-2026-1457) (exploit.rules)

Modified inactive rules:

  • 2867847 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)