Ruleset Update Summary - 2026/09/30 - v11301

Ruleset Updates
1

Summary:

10 new OPEN, 21 new PRO (10 + 11)

Added rules:

Open:

  • 2072301 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (beacon .kraynov .org) (malware.rules)
  • 2072302 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (ref-api .homefulia .com) (malware.rules)
  • 2072303 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (beacon .kraynov .org) (malware.rules)
  • 2072304 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (ref-api .homefulia .com) (malware.rules)
  • 2072305 - ET INFO DYNAMIC_DNS Query to a *.coadautodoor .com domain (info.rules)
  • 2072306 - ET INFO DYNAMIC_DNS HTTP Request to a *.coadautodoor .com domain (info.rules)
  • 2072307 - ET INFO DYNAMIC_DNS Query to a *.extratechsolutions .com domain (info.rules)
  • 2072308 - ET INFO DYNAMIC_DNS HTTP Request to a *.extratechsolutions .com domain (info.rules)
  • 2072309 - ET INFO DYNAMIC_DNS Query to a *.gz-associates .com domain (info.rules)
  • 2072310 - ET INFO DYNAMIC_DNS HTTP Request to a *.gz-associates .com domain (info.rules)

Pro:

  • 2868719 - ETPRO MALWARE CLoader CnC Fetch Payload (malware.rules)
  • 2868720 - ETPRO MALWARE CLoader CnC Run Command M1 (malware.rules)
  • 2868721 - ETPRO MALWARE CLoader CnC Run Command M2 (malware.rules)
  • 2868722 - ETPRO EXPLOIT Citrix DTLSv1.0 Unauthenticated Buffer Overflow (CVE-2026-88772) (exploit.rules)
  • 2868723 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2868724 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2868725 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2868726 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2868727 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
  • 2868728 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
  • 2868729 - ETPRO MALWARE TA406 CnC Activity (Beacon) (malware.rules)