Ruleset Update Summary - 2026/09/16 - v11291

Ruleset Updates
1

Summary:

6 new OPEN, 11 new PRO (6 + 5)

Added rules:

Open:

  • 2072050 - ET WEB_SPECIFIC_APPS D-Link ve_mgr.cgi f_dev Parameter Command Injection Attempt (CVE-2026-82690) (web_specific_apps.rules)
  • 2072051 - ET WEB_SPECIFIC_APPS D-Link dsk_mgr.cgi Multiple Functions and Multiple Parameters Command Injection Attempt (CVE-2026-4206) (web_specific_apps.rules)
  • 2072052 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (push-api .daibeltrading .com) (malware.rules)
  • 2072053 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (push-api .daibeltrading .com) (malware.rules)
  • 2072054 - ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (yelahaye .surf) (exploit_kit.rules)
  • 2072055 - ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (yelahaye .surf) (exploit_kit.rules)

Pro:

  • 2868619 - ETPRO MALWARE Mafia Ransomware Victim Checkin (POST) (malware.rules)
  • 2868620 - ETPRO MALWARE Mafia Ransomware Checkin Response (malware.rules)
  • 2868621 - ETPRO MALWARE Remus CnC Victim Checkin M2 (malware.rules)
  • 2868622 - ETPRO MALWARE Remus CnC Victim Checkin M3 (malware.rules)
  • 2868623 - ETPRO MALWARE Remus CnC Victim Checkin M4 (malware.rules)

Disabled and modified rules:

  • 2060566 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in DNS Lookup (zarantech .com) (exploit_kit.rules)
  • 2060569 - ET EXPLOIT_KIT Malicious TA2726 TDS Domain in TLS SNI (zarantech .com) (exploit_kit.rules)