Ruleset Update Summary - 2026/10/01 - v11302

Ruleset Updates
1

Summary:

11 new OPEN, 21 new PRO (11 + 10)

Thanks Ivan

Added rules:

Open:

  • 2072311 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (stcdn .yuriykraynov .com) (malware.rules)
  • 2072312 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (stcdn .yuriykraynov .com) (malware.rules)
  • 2072313 - ET MALWARE PackClient Core startup probe state (malware.rules)
  • 2072314 - ET MALWARE PackClient Core startup response state (malware.rules)
  • 2072315 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (okx3 .io) (malware.rules)
  • 2072316 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (okx3 .io) (malware.rules)
  • 2072317 - ET EXPLOIT F5 BIG-IP APM Unauthenticated Auth Header Heap Overflow (CVE-2026-94127) (exploit.rules)
  • 2072318 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (perforatedmwqn .shop) (malware.rules)
  • 2072319 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (perforatedmwqn .shop) in TLS SNI (malware.rules)
  • 2072320 - ET WEB_SPECIFIC_APPS Kestra OSS Unauthenticated OS Command Injection (CVE-2026-49869) (web_specific_apps.rules)
  • 2072321 - ET EXPLOIT_KIT Observed ClickFix Cookie (exploit_kit.rules)

Pro:

  • 2868730 - ETPRO EXPLOIT Microsoft SharePoint Unauthenticated RCE via EditingPageParser Type-Check Bypass (CVE-2026-65660) (exploit.rules)
  • 2868731 - ETPRO MALWARE Remus Stealer CnC Handshake (malware.rules)
  • 2868732 - ETPRO MALWARE Remus Stealer CnC Handshake (malware.rules)
  • 2868733 - ETPRO MALWARE Remus Stealer CnC Handshake (malware.rules)
  • 2868734 - ETPRO EXPLOIT_KIT Observed DNS Query to LandUpdate808 Domain (exploit_kit.rules)
  • 2868735 - ETPRO EXPLOIT_KIT Observed LandUpdate808 Domain in TLS SNI (exploit_kit.rules)
  • 2868736 - ETPRO MALWARE Observed DNS Query to Remus Stealer Domain (malware.rules)
  • 2868737 - ETPRO MALWARE Observed Remus Stealer Domain in TLS SNI (malware.rules)
  • 2868738 - ETPRO EXPLOIT_KIT Observed DNS Query to LandUpdate808 Domain (exploit_kit.rules)
  • 2868739 - ETPRO MALWARE Observed LandUpdate808 Domain in TLS SNI (malware.rules)
SIGS: PackClient stream-aware signatures and Core startup correlation
2

With @Ivan’s permission, Emerging Threats would like to formally give kudos to :star: Ivan Immanuel Shaji :star: for his contributions to PackClient RAT coverage.

Find his work along Emerging Threats’ @trobinson667 here: SIGS: PackClient stream-aware signatures and Core startup correlation

Join the fun and submit your signature ideas today!

2 Likes