Ruleset Update Summary - 2026/09/18 - v11293

Ruleset Updates
1

Summary:

9 new OPEN, 25 new PRO (9 + 16)

Added rules:

Open:

  • 2072090 - ET MALWARE MakinoLoader CnC Checkin (malware.rules)
  • 2072091 - ET MALWARE MakinoLoader CnC Checkin Response (malware.rules)
  • 2072092 - ET MALWARE MakinoLoader Victim Send Sysinfo (malware.rules)
  • 2072093 - ET MALWARE MakinoLoader Victim HeartBeat (malware.rules)
  • 2072094 - ET MALWARE MakinoLoader Victim Send AV Details (malware.rules)
  • 2072095 - ET MALWARE AsyncRAT Payload Request (.ps1) (malware.rules)
  • 2072096 - ET MALWARE AsyncRAT Powershell Payload (malware.rules)
  • 2072097 - ET MALWARE Request to ReverseLoader Payload (malware.rules)
  • 2072098 - ET WEB_SPECIFIC_APPS D-Link system_mgr.cgi Multiple Parameters Command Injection Attempt (CVE-2026-4207) (web_specific_apps.rules)

Pro:

  • 2868671 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868672 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868673 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868674 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868675 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868676 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868677 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868678 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868679 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868680 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868681 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868682 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868683 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868684 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868685 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868686 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

Disabled and modified rules:

  • 2868654 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868658 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868663 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868668 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868670 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

Removed rules:

  • 2868364 - ETPRO MALWARE MakinoLoader CnC Checkin (malware.rules)
  • 2868365 - ETPRO MALWARE MakinoLoader CnC Checkin Response (malware.rules)
  • 2868366 - ETPRO MALWARE MakinoLoader Victim Send Sysinfo (malware.rules)
  • 2868367 - ETPRO MALWARE MakinoLoader Victim HeartBeat (malware.rules)
  • 2868368 - ETPRO MALWARE MakinoLoader Victim Send AV Details (malware.rules)