Ruleset Update Summary - 2026/10/05 - v11304

Ruleset Updates
1

Summary:

19 new OPEN, 20 new PRO (19 + 1)

Added rules:

Open:

  • 2072351 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cf-cdn .viktorkraynov .com) (malware.rules)
  • 2072352 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (js-stable .pupplements .com) (malware.rules)
  • 2072353 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cf-cdn .viktorkraynov .com) (malware.rules)
  • 2072354 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (js-stable .pupplements .com) (malware.rules)
  • 2072355 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (convuey .cyou) (malware.rules)
  • 2072356 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (convuey .cyou) in TLS SNI (malware.rules)
  • 2072357 - ET MALWARE Base64 Encoded Executable Within JPG File (malware.rules)
  • 2072358 - ET MALWARE Base64 Encoded Executable Within PNG File (malware.rules)
  • 2072359 - ET MALWARE Base64 Encoded XML Declaration Within JPG File (malware.rules)
  • 2072360 - ET MALWARE Base64 Encoded XML Declaration Within PNG File (malware.rules)
  • 2072361 - ET MALWARE ContEXE Stealer User-Agent string (ContEXE-C/1.0) in HTTP Request (malware.rules)
  • 2072362 - ET MALWARE ContEXE Stealer CnC Checkin Attempt (malware.rules)
  • 2072363 - ET MALWARE ContEXE Stealer CnC Checkin - C2 Response (malware.rules)
  • 2072364 - ET MALWARE ContEXE Stealer Heartbeat Check (malware.rules)
  • 2072365 - ET MALWARE ContEXE Stealer Heartbeat Check - C2 Response (malware.rules)
  • 2072366 - ET MALWARE ContEXE Stealer CnC Domain in DNS Lookup (safydomainredyr .info) (malware.rules)
  • 2072367 - ET MALWARE ContEXE Stealer CnC Domain in DNS Lookup (wsafydomainredyr .info) (malware.rules)
  • 2072368 - ET MALWARE Observed ContEXE Stealer Domain (safydomainredyr .info in TLS SNI) (malware.rules)
  • 2072369 - ET MALWARE Observed ContEXE Stealer Domain (wsafydomainredyr .info in TLS SNI) (malware.rules)

Pro:

  • 2868747 - ETPRO MALWARE Request to Greatness Phishkit Landing Page (malware.rules)