Ruleset Update Summary - 2026/10/12 - v11309

Ruleset Updates
1

Summary:

17 new OPEN, 21 new PRO (17 + 4)

Added rules:

Open:

  • 2072410 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reliabledmwqj .shop) (malware.rules)
  • 2072411 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reliabledmwqj .shop) in TLS SNI (malware.rules)
  • 2072412 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (prod-static .nascarnash .com) (malware.rules)
  • 2072413 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (prod-static .nascarnash .com) (malware.rules)
  • 2072414 - ET ADWARE_PUP Request For Third-Party Windows Activation Script (adware_pup.rules)
  • 2072415 - ET MALWARE Generic PowerShell Loader Payload Request (malware.rules)
  • 2072416 - ET MALWARE Observed DNS Query to Generic Powershell Loader Payload Domain (conti .pk) (malware.rules)
  • 2072417 - ET MALWARE Observed Generic Powershell Loader Payload Domain (conti .pk in TLS SNI) (malware.rules)
  • 2072418 - ET ADWARE_PUP Observed DNS Query to Windows Activation Script Domain (get .activated .win) (adware_pup.rules)
  • 2072419 - ET ADWARE_PUP Observed Windows Activation Script Domain (get .activated .win in TLS SNI) (adware_pup.rules)
  • 2072420 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (fins .workers .dev) (malware.rules)
  • 2072421 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (nffnj .workers .dev) (malware.rules)
  • 2072422 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (filedu .workers .dev) (malware.rules)
  • 2072423 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (fins .workers .dev) (malware.rules)
  • 2072424 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (nffnj .workers .dev) (malware.rules)
  • 2072425 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (filedu .workers .dev) (malware.rules)
  • 2072426 - ET HUNTING Fake Windows User-Agent Observed (hunting.rules)

Pro:

  • 2868775 - ETPRO HUNTING Observed Javascript Obfuscation CharCode for atob and document (hunting.rules)
  • 2868776 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)
  • 2868777 - ETPRO MALWARE MasqradFix Payload Embedded Within PNG (malware.rules)
  • 2868778 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)