Ruleset Update Summary - 2026/09/21 - v11294

Ruleset Updates
1

Summary:

26 new OPEN, 31 new PRO (26 + 5)

Added rules:

Open:

  • 2072099 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (mprevive .com) (malware.rules)
  • 2072100 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (beta-into .space) (malware.rules)
  • 2072101 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (vooi-app .xyz) (malware.rules)
  • 2072102 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (opinionvip .club) (malware.rules)
  • 2072103 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (app-open .click) (malware.rules)
  • 2072104 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (mprevive .com) (malware.rules)
  • 2072105 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (beta-into .space) (malware.rules)
  • 2072106 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (vooi-app .xyz) (malware.rules)
  • 2072107 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (opinionvip .club) (malware.rules)
  • 2072108 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (app-open .click) (malware.rules)
  • 2072109 - ET MALWARE GateSentinel C2 RemoteTool Registration (malware.rules)
  • 2072110 - ET MALWARE GateSentinel C2 RemoteTool Heartbeat (malware.rules)
  • 2072111 - ET MALWARE GateSentinel C2 RemoteTool User-Agent (Beacon/) (malware.rules)
  • 2072112 - ET MALWARE GateSentinel C2 RemoteTool Task (sleep) (malware.rules)
  • 2072113 - ET MALWARE GateSentinel C2 RemoteTool Task (process enum) (malware.rules)
  • 2072114 - ET MALWARE GateSentinel C2 RemoteTool Task (shellcode) (malware.rules)
  • 2072115 - ET MALWARE GateSentinel C2 RemoteTool Task (command) (malware.rules)
  • 2072116 - ET MALWARE PATCHCORD C2 Task (browser hijack) (malware.rules)
  • 2072117 - ET INFO DYNAMIC_DNS Query to a *.cthulhu .li domain (info.rules)
  • 2072118 - ET INFO DYNAMIC_DNS HTTP Request to a *.cthulhu .li domain (info.rules)
  • 2072119 - ET INFO DYNAMIC_DNS Query to a *.brianneburnell .com domain (info.rules)
  • 2072120 - ET INFO DYNAMIC_DNS HTTP Request to a *.brianneburnell .com domain (info.rules)
  • 2072121 - ET WEB_SPECIFIC_APPS Netcore network_tools x Parameter Command Injection Attempt (CVE-2026-94097) (web_specific_apps.rules)
  • 2072122 - ET WEB_SPECIFIC_APPS ipTIME d.cgi aaksjdkfj Parameter Command Injection Attempt (CVE-2026-1741) (web_specific_apps.rules)
  • 2072123 - ET WEB_SPECIFIC_APPS Comfast mbox-config timestr Parameter Buffer Overflow Attempt (CVE-2026-78050) (web_specific_apps.rules)
  • 2072124 - ET WEB_SPECIFIC_APPS Comfast mbox-config timestr Parameter Command Injection Attempt (CVE-2026-77683) (web_specific_apps.rules)

Pro:

  • 2868687 - ETPRO MALWARE TA4903 DetectProvider Initialize (malware.rules)
  • 2868688 - ETPRO MALWARE TA4903 DetectProvider Send Account Email (malware.rules)
  • 2868689 - ETPRO MALWARE TA4903 DetectProvider Send Account Email Response (malware.rules)
  • 2868690 - ETPRO MALWARE TA4903 DetectProvider Start Capture (malware.rules)
  • 2868691 - ETPRO MALWARE TA4903 DetectProvider Start Capture Response (malware.rules)

Modified inactive rules:

  • 2868668 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868670 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)