Summary:
17 new OPEN, 17 new PRO (17 + 0)
Added rules:
Open:
- 2072388 - ET WEB_SPECIFIC_APPS Next.js Manifest Disclosure via Path Traversal (web_specific_apps.rules)
- 2072389 - ET WEB_SPECIFIC_APPS Next.js Unauthenticated Remote Code Execution (CVE-2026-75604) (web_specific_apps.rules)
- 2072390 - ET HUNTING Generic FTP Command STOR SQLi (hunting.rules)
- 2072391 - ET WEB_SERVER Cisco Catalyst SD-WAN Manager API Authentication Bypass (CVE-2026-76504) (web_server.rules)
- 2072392 - ET WEB_SPECIFIC_APPS Atlassian Unauthenticated Arbitrary File Read (CVE-2026-21589) (web_specific_apps.rules)
- 2072393 - ET WEB_SPECIFIC_APPS Rejetto HTTP File Server Unauthenticated Admin Cookie Request (CVE-2026-61500) (web_specific_apps.rules)
- 2072394 - ET WEB_SPECIFIC_APPS Rejetto HTTP File Server Unauthenticated Admin Cookie Response (CVE-2026-61500) (web_specific_apps.rules)
- 2072395 - ET INFO kcptun Null Encryption Session Initiation - Snappy Compression (info.rules)
- 2072396 - ET INFO kcptun Null Encryption Message Header (info.rules)
- 2072397 - ET WEB_SPECIFIC_APPS Hytec popen.cgi command Parameter Command Injection Attempt (CVE-2022-36553) (web_specific_apps.rules)
- 2072398 - ET WEB_SPECIFIC_APPS MeiG SetRemoteAccessCfg password Parameter Command Injection Attempt (CVE-2026-36356) (web_specific_apps.rules)
- 2072399 - ET WEB_SPECIFIC_APPS JFrog Self-Managed Artifactory Authentication Bypass (CVE-2026-82329) (web_specific_apps.rules)
- 2072400 - ET MALWARE CountLoader Payload Request (malware.rules)
- 2072401 - ET MALWARE CountLoader CnC Checkin (malware.rules)
- 2072402 - ET MALWARE CountLoader CnC Task Request (malware.rules)
- 2072403 - ET MALWARE CountLoader CnC Response (malware.rules)
- 2072404 - ET MALWARE CountLoader Victim Send Task Execution Result (malware.rules)
Removed rules:
- 2067040 - ET INFO DNS Query for Webhook/HTTP Request Inspection Service (webhook .site) (info.rules)
- 2067060 - ET INFO Observed Webhook/HTTP Request Inspection Service Domain (webhook .site) in TLS SNI (info.rules)