Ruleset Update Summary - 2026/10/02 - v11303

Ruleset Updates
1

Summary:

29 new OPEN, 36 new PRO (29 + 7)

Added rules:

Open:

  • 2072322 - ET MALWARE nginstaller PHP Webshell Command Execution Header (HTTP_NSC_LDAP) Inbound (malware.rules)
  • 2072323 - ET MALWARE nginstaller PHP Webshell Command Execution Header (HTTP_NSC_CLIENTTYPE) Inbound (malware.rules)
  • 2072324 - ET MALWARE WHIPSHOT PHP Webshell Chunked Based64 Transport Header Inbound (malware.rules)
  • 2072325 - ET WEB_SERVER Check Point Management Server Non-Alphanumeric targetVersion (CVE-2026-93616) (web_server.rules)
  • 2072326 - ET WEB_SPECIFIC_APPS MLflow Unauthenticated Server-Side Request Forgery via Webhook HTTP Redirect (CVE-2026-64849) (web_specific_apps.rules)
  • 2072327 - ET MALWARE Observed DNS Query to ClickFix Domain (pyhajarvi-instituutti .fi) (malware.rules)
  • 2072328 - ET MALWARE Observed DNS Query to ClickFix Domain (xaz2 .com) (malware.rules)
  • 2072329 - ET MALWARE Observed DNS Query to ClickFix Domain (taikakuu .com) (malware.rules)
  • 2072330 - ET MALWARE Observed DNS Query to ClickFix Domain (propertytaxloan .com) (malware.rules)
  • 2072331 - ET MALWARE Observed DNS Query to ClickFix Domain (sahko-team .fi) (malware.rules)
  • 2072332 - ET MALWARE Observed DNS Query to ClickFix Domain (fol9 .com) (malware.rules)
  • 2072333 - ET MALWARE Observed DNS Query to ClickFix Domain (smokingstationhub .com) (malware.rules)
  • 2072334 - ET MALWARE Observed DNS Query to ClickFix Domain (sepolia .gateway .tenderly .co) (malware.rules)
  • 2072335 - ET MALWARE Observed DNS Query to ClickFix Domain (gateway .tenderly .co) (malware.rules)
  • 2072336 - ET MALWARE Observed DNS Query to ClickFix Domain (zvh4 .com) (malware.rules)
  • 2072337 - ET MALWARE Observed DNS Query to ClickFix Domain (qaz4 .com) (malware.rules)
  • 2072338 - ET MALWARE Observed ClickFix Domain (pyhajarvi-instituutti .fi in TLS SNI) (malware.rules)
  • 2072339 - ET MALWARE Observed ClickFix Domain (xaz2 .com in TLS SNI) (malware.rules)
  • 2072340 - ET MALWARE Observed ClickFix Domain (taikakuu .com in TLS SNI) (malware.rules)
  • 2072341 - ET MALWARE Observed ClickFix Domain (propertytaxloan .com in TLS SNI) (malware.rules)
  • 2072342 - ET MALWARE Observed ClickFix Domain (sahko-team .fi in TLS SNI) (malware.rules)
  • 2072343 - ET MALWARE Observed ClickFix Domain (fol9 .com in TLS SNI) (malware.rules)
  • 2072344 - ET MALWARE Observed ClickFix Domain (smokingstationhub .com in TLS SNI) (malware.rules)
  • 2072345 - ET MALWARE Observed ClickFix Domain (sepolia .gateway .tenderly .co in TLS SNI) (malware.rules)
  • 2072346 - ET MALWARE Observed ClickFix Domain (gateway .tenderly .co in TLS SNI) (malware.rules)
  • 2072347 - ET MALWARE Observed ClickFix Domain (zvh4 .com in TLS SNI) (malware.rules)
  • 2072348 - ET MALWARE Observed ClickFix Domain (qaz4 .com in TLS SNI) (malware.rules)
  • 2072349 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mutterunlikelyoo .shop) (malware.rules)
  • 2072350 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mutterunlikelyoo .shop) in TLS SNI (malware.rules)

Pro:

  • 2868740 - ETPRO EXPLOIT_KIT ClickFix Filter Check (exploit_kit.rules)
  • 2868741 - ETPRO EXPLOIT_KIT ClickFix Fetch Powershell Commands (exploit_kit.rules)
  • 2868742 - ETPRO WEB_SERVER Check Point Management Server Unauthenticated RCE via Upload Path Traversal (CVE-2026-93616) (web_server.rules)
  • 2868743 - ETPRO MALWARE LandUpdate808 Related Host Profile Exfil (malware.rules)
  • 2868744 - ETPRO MALWARE LandUpdate808 Related CnC Activity (malware.rules)
  • 2868745 - ETPRO ATTACK_RESPONSE LandUpdate808 Malicious WordPress Plugin Installer Observed (attack_response.rules)
  • 2868746 - ETPRO MALWARE LandUpdate808 Related Payload Request (malware.rules)