Ruleset Update Summary - 2026/09/15 - v11290

Ruleset Updates
1

Summary:

12 new OPEN, 15 new PRO (12 + 3)

Added rules:

Open:

  • 2072038 - ET INFO Observed KingSoft Office Domain in DNS Lookup (ksord .com) (info.rules)
  • 2072039 - ET INFO Observed KingSoft Office Domain in TLS SNI (ksord .com) (info.rules)
  • 2072040 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (* .zecurit .com) (info.rules)
  • 2072041 - ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (* .zecurit .com) (info.rules)
  • 2072042 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (front-api .ecodevelopmentltd .com) (malware.rules)
  • 2072043 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (front-api .ecodevelopmentltd .com) (malware.rules)
  • 2072044 - ET MALWARE Observed DNS Query to ACR Stealer Domain (requests .nicotine .surf) (malware.rules)
  • 2072045 - ET MALWARE Observed DNS Query to ACR Stealer Domain (enable-debug .empower .surf) (malware.rules)
  • 2072046 - ET MALWARE Observed DNS Query to ACR Stealer Domain (mail .novaform .cc) (malware.rules)
  • 2072047 - ET MALWARE Observed ACR Stealer Domain (requests .nicotine .surf in TLS SNI) (malware.rules)
  • 2072048 - ET MALWARE Observed ACR Stealer Domain (enable-debug .empower .surf in TLS SNI) (malware.rules)
  • 2072049 - ET MALWARE Observed ACR Stealer Domain (mail .novaform .cc in TLS SNI) (malware.rules)

Pro:

  • 2868616 - ETPRO ATTACK_RESPONSE ACRStealer Powershell Payload Inbound (attack_response.rules)
  • 2868617 - ETPRO MALWARE ACRStealer Retrieve Config (malware.rules)
  • 2868618 - ETPRO MALWARE ACRStealer CnC Activity (POST) (malware.rules)