Ruleset Update Summary - 2026/10/14 - v11311

Ruleset Updates
1

Summary:

6 new OPEN, 27 new PRO (6 + 21)

Added rules:

Open:

  • 2072446 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (testing .0b3l1sk .me) (malware.rules)
  • 2072447 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (testing .0b3l1sk .me) in TLS SNI (malware.rules)
  • 2072448 - ET HUNTING PowerShell Request to cdn .jsdelivr .net (hunting.rules)
  • 2072449 - ET EXPLOIT_KIT BlueMoon Exploit Kit Status Callback (exploit_kit.rules)
  • 2072450 - ET EXPLOIT_KIT BlueMoon Exploit Kit Worker Binary Payload (exploit_kit.rules)
  • 2072451 - ET EXPLOIT_KIT BlueMoon Exploit Kit Non-Worker Fallback Binary Payload (exploit_kit.rules)

Pro:

  • 2868799 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware GitHub Actions Workflow (malware.rules)
  • 2868800 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
  • 2868801 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
  • 2868802 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M1 (malware.rules)
  • 2868803 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M2 (malware.rules)
  • 2868804 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M3 (malware.rules)
  • 2868805 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M1 (malware.rules)
  • 2868806 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M2 (malware.rules)
  • 2868807 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M3 (malware.rules)
  • 2868808 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
  • 2868809 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868810 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868811 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868812 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868813 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868814 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868815 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868816 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868817 - ETPRO MALWARE TA402 CnC Fetch New Google OAuth Token (malware.rules)
  • 2868818 - ETPRO MALWARE TA402 CnC Exfil Host Info (malware.rules)
  • 2868819 - ETPRO MALWARE TA402 CnC Poll for Commands (malware.rules)

Disabled and modified rules:

  • 2072335 - ET MALWARE Observed DNS Query to ClickFix Domain (gateway .tenderly .co) (malware.rules)
  • 2072346 - ET MALWARE Observed ClickFix Domain (gateway .tenderly .co in TLS SNI) (malware.rules)