Ruleset Update Summary - 2026/10/07 - v11306

Ruleset Updates
1

Summary:

5 new OPEN, 17 new PRO (5 + 12)

Added rules:

Open:

  • 2072383 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (fw-static .nashbashracing .org) (malware.rules)
  • 2072384 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (match .sitefulia .com) (malware.rules)
  • 2072385 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (fw-static .nashbashracing .org) (malware.rules)
  • 2072386 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (match .sitefulia .com) (malware.rules)
  • 2072387 - ET HUNTING Javascript Redirect to Google .com (hunting.rules)

Pro:

  • 2868750 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868751 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868752 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868753 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868754 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868755 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868756 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868757 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868758 - ETPRO EXPLOIT_KIT Observed DNS Query to ClickFix Domain (exploit_kit.rules)
  • 2868759 - ETPRO EXPLOIT_KIT Observed ClickFix Domain in TLS SNI (exploit_kit.rules)
  • 2868760 - ETPRO EXPLOIT_KIT ClickFix Landing Page Observed (exploit_kit.rules)
  • 2868761 - ETPRO MALWARE ClickFix Landing Page Observed (malware.rules)