Ruleset Update Summary - 2026/09/17 - v11292

Ruleset Updates
1

Summary:

34 new OPEN, 81 new PRO (34 + 47)

Added rules:

Open:

  • 2072056 - ET PHISHING Generic Phish Request to RMM M1 2026-09-16 (phishing.rules)
  • 2072057 - ET PHISHING Generic Phish Request to RMM M2 2026-09-16 (phishing.rules)
  • 2072058 - ET INFO Zecurit RMM Activity - Agent Registration (info.rules)
  • 2072059 - ET INFO Zecurit RMM Activity - Agent Outbound Command Sent (info.rules)
  • 2072060 - ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved (info.rules)
  • 2072061 - ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL (info.rules)
  • 2072062 - ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint (info.rules)
  • 2072063 - ET INFO External IP Lookup - ipleak .net (info.rules)
  • 2072064 - ET INFO External IP Lookup Domain (ipleak .net) in DNS Lookup (info.rules)
  • 2072065 - ET INFO Observed External IP Lookup Domain (ipleak .net) in TLS SNI (info.rules)
  • 2072066 - ET INFO DYNAMIC_DNS Query to a *.robertschulze .org domain (info.rules)
  • 2072067 - ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .org domain (info.rules)
  • 2072068 - ET INFO DYNAMIC_DNS Query to a *.chanka .com domain (info.rules)
  • 2072069 - ET INFO DYNAMIC_DNS HTTP Request to a *.chanka .com domain (info.rules)
  • 2072070 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (oceanpebble .shop) (malware.rules)
  • 2072071 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (oceanpebble .shop) in TLS SNI (malware.rules)
  • 2072072 - ET MALWARE AMOS ClickFix Campaign - Bash Stager M1 (malware.rules)
  • 2072073 - ET MALWARE AMOS ClickFix Campaign - Bash Stager M2 (malware.rules)
  • 2072074 - ET MALWARE AMOS ClickFix Campaign - AMOS Payload Request (malware.rules)
  • 2072075 - ET MALWARE AMOS ClickFix Campaign - AMOS Loader Script Request (malware.rules)
  • 2072076 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (engine .commdistinc .com) (malware.rules)
  • 2072077 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (engine .commdistinc .com) (malware.rules)
  • 2072078 - ET MALWARE Observed DNS Query to BlueMoon EK CnC (malware.rules)
  • 2072079 - ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI (malware.rules)
  • 2072080 - ET MALWARE Observed BlueMoon EK CnC Related Domain in DNS Query (malware.rules)
  • 2072081 - ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI (malware.rules)
  • 2072082 - ET MALWARE Observed Cobalt Strike CnC Related Domain in DNS Query (malware.rules)
  • 2072083 - ET MALWARE Observed CobaltStrike CnC Related Domain in TLS SNI (malware.rules)
  • 2072084 - ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query (malware.rules)
  • 2072085 - ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI (malware.rules)
  • 2072086 - ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query (malware.rules)
  • 2072087 - ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI (malware.rules)
  • 2072088 - ET MALWARE Observed DarkSword EK Related Domain in DNS Query (malware.rules)
  • 2072089 - ET MALWARE Observed DarkSword EK Related Domain in TLS SNI (malware.rules)

Pro:

  • 2868624 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868625 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868626 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868627 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868628 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868629 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868630 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868631 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868632 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868633 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868634 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868635 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868636 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868637 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868638 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868639 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868640 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868641 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868642 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868643 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868644 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868645 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868646 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868647 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868648 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868649 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868650 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868651 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868652 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868653 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868654 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868655 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868656 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868657 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868658 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868659 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
  • 2868660 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
  • 2868661 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
  • 2868662 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
  • 2868663 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868664 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
  • 2868665 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868666 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
  • 2868667 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868668 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868669 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
  • 2868670 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)