Ruleset Update Summary - 2026/10/13 - v11310

Ruleset Updates
1

Summary:

19 new OPEN, 39 new PRO (19 + 20)

Added rules:

Open:

  • 2072427 - ET WEB_SERVER Ivanti Connect Secure Authentication Bypass (CVE-2026-104935) (web_server.rules)
  • 2072428 - ET WEB_SPECIFIC_APPS Tenda F456 Router Page Parameter Buffer Overflow (CVE-2026-9389) (web_specific_apps.rules)
  • 2072429 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (tools .studerandson .com) (malware.rules)
  • 2072430 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (tools .studerandson .com) (malware.rules)
  • 2072431 - ET WEB_SPECIFIC_APPS CraftCMS element-search typecastBeforeSave Remote Code Execution Attempt (CVE-2026-44011) (web_specific_apps.rules)
  • 2072432 - ET WEB_SPECIFIC_APPS TRENDnet formTcpipSetup name Parameter Buffer Overflow Attempt (CVE-2026-109157) (web_specific_apps.rules)
  • 2072433 - ET WEB_SPECIFIC_APPS TRENDnet formWlanSetup enrollee Parameter Command Injection Attempt (CVE-2026-10182) (web_specific_apps.rules)
  • 2072434 - ET WEB_SPECIFIC_APPS TRENDnet formWlanSetup enrollee Parameter Buffer Overflow Attempt (CVE-2026-10183) (web_specific_apps.rules)
  • 2072435 - ET WEB_SPECIFIC_APPS GitLab Unauthenticated Arbitrary File Read (CVE-2026-85706) (web_specific_apps.rules)
  • 2072436 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (foundations .bond) (malware.rules)
  • 2072437 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (ncsgo .workers .dev) (malware.rules)
  • 2072438 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (mcfind .workers .dev) (malware.rules)
  • 2072439 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (tesso2 .workers .dev) (malware.rules)
  • 2072440 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (zkffh-amilok .workers .dev) (malware.rules)
  • 2072441 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (foundations .bond) (malware.rules)
  • 2072442 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (ncsgo .workers .dev) (malware.rules)
  • 2072443 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (mcfind .workers .dev) (malware.rules)
  • 2072444 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (tesso2 .workers .dev) (malware.rules)
  • 2072445 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (zkffh-amilok .workers .dev) (malware.rules)

Pro:

  • 2868779 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868780 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868781 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868782 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868783 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868784 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868785 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868786 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868787 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868788 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868789 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868790 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868791 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868792 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868793 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868794 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868795 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868796 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)
  • 2868797 - ETPRO MALWARE MasqradFix Web Inject Payload Request (malware.rules)
  • 2868798 - ETPRO MALWARE MasqradFix Host Profile Exfil (malware.rules)