Ruleset Update Summary - 2026/10/15 - v11312

Ruleset Updates
1

Summary:

49 new OPEN, 61 new PRO (49 + 12)

Added rules:

Open:

  • 2072452 - ET HUNTING HTML Embedded JavaScript with Non-Executing Script Block (hunting.rules)
  • 2072453 - ET HUNTING HTML Embedded JavaScript Extraction via URL.createObjectURL (hunting.rules)
  • 2072454 - ET HUNTING Javascript Float64/Uint32 Typed-Array ArrayBuffer Aliasing (hunting.rules)
  • 2072455 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (st-attr .robstuder .org) (malware.rules)
  • 2072456 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (st-attr .robstuder .org) (malware.rules)
  • 2072457 - ET INFO DNS Query to Cloudflare Tunneling Domain (cfargotunnel .com) (info.rules)
  • 2072458 - ET INFO Observed Cloudflare Tunneling Domain (cfargotunnel .com) in TLS SNI (info.rules)
  • 2072459 - ET WEB_SPECIFIC_APPS Adobe Commerce Checkout Remote Code Execution (CVE-2022-24086) (web_specific_apps.rules)
  • 2072460 - ET WEB_SPECIFIC_APPS Advantech WISE-IoTSuite/SaaS SQL Injection (CVE-2025-52694) (web_specific_apps.rules)
  • 2072461 - ET HUNTING AdFection Related Domain in DNS Lookup (tracookiepixel .xyz) (hunting.rules)
  • 2072462 - ET HUNTING AdFection Related Domain in DNS Lookup (cookiesurfer .com) (hunting.rules)
  • 2072463 - ET HUNTING AdFection Related Domain in DNS Lookup (cookie-sync .xyz) (hunting.rules)
  • 2072464 - ET HUNTING AdFection Related Domain in DNS Lookup (ads-monitor .xyz) (hunting.rules)
  • 2072465 - ET HUNTING AdFection Related Domain in DNS Lookup (checkmyimp .com) (hunting.rules)
  • 2072466 - ET HUNTING AdFection Related Domain in DNS Lookup (ads-impressions .com) (hunting.rules)
  • 2072467 - ET HUNTING AdFection Related Domain in DNS Lookup (nutralove .co) (hunting.rules)
  • 2072468 - ET HUNTING AdFection Related Domain in DNS Lookup (noas .adtimizer .co) (hunting.rules)
  • 2072469 - ET HUNTING AdFection Related Domain in DNS Lookup (noas .impchkdsp .com) (hunting.rules)
  • 2072470 - ET HUNTING AdFection Related Domain in DNS Lookup (noas .trakking .co) (hunting.rules)
  • 2072471 - ET HUNTING AdFection Related Domain in TLS SNI (tracookiepixel .xyz) (hunting.rules)
  • 2072472 - ET HUNTING AdFection Related Domain in TLS SNI (cookiesurfer .com) (hunting.rules)
  • 2072473 - ET HUNTING AdFection Related Domain in TLS SNI (cookie-sync .xyz) (hunting.rules)
  • 2072474 - ET HUNTING AdFection Related Domain in TLS SNI (ads-monitor .xyz) (hunting.rules)
  • 2072475 - ET HUNTING AdFection Related Domain in TLS SNI (checkmyimp .com) (hunting.rules)
  • 2072476 - ET HUNTING AdFection Related Domain in TLS SNI (ads-impressions .com) (hunting.rules)
  • 2072477 - ET HUNTING AdFection Related Domain in TLS SNI (nutralove .co) (hunting.rules)
  • 2072478 - ET HUNTING AdFection Related Domain in TLS SNI (noas .adtimizer .co) (hunting.rules)
  • 2072479 - ET HUNTING AdFection Related Domain in TLS SNI (noas .impchkdsp .com) (hunting.rules)
  • 2072480 - ET HUNTING AdFection Related Domain in TLS SNI (noas .trakking .co) (hunting.rules)
  • 2072481 - ET EXPLOIT Advantech R-SeeNet Unauthenticated Vulnerable Version Response (CVE-2023-5642) (exploit.rules)
  • 2072482 - ET EXPLOIT Advantech R-SeeNet Unauthenticated snmpmon.ini Information Disclosure (CVE-2023-5642) (exploit.rules)
  • 2072483 - ET HUNTING AdFection Related Domain in DNS Lookup (discover-tech .io) (hunting.rules)
  • 2072484 - ET HUNTING AdFection Related Domain in DNS Lookup (mydsp .io) (hunting.rules)
  • 2072485 - ET HUNTING AdFection Related Domain in DNS Lookup (controlium .net) (hunting.rules)
  • 2072486 - ET HUNTING AdFection Related Domain in DNS Lookup (powerium .net) (hunting.rules)
  • 2072487 - ET HUNTING AdFection Related Domain in DNS Lookup (platc-tester .com) (hunting.rules)
  • 2072488 - ET HUNTING AdFection Related Domain in DNS Lookup (myweb3id .io) (hunting.rules)
  • 2072489 - ET HUNTING AdFection Related Domain in DNS Lookup (myipinfo .io) (hunting.rules)
  • 2072490 - ET HUNTING AdFection Related Domain in DNS Lookup (akedo .gg) (hunting.rules)
  • 2072491 - ET HUNTING AdFection Related Domain in TLS SNI (discover-tech .io) (hunting.rules)
  • 2072492 - ET HUNTING AdFection Related Domain in TLS SNI (mydsp .io) (hunting.rules)
  • 2072493 - ET HUNTING AdFection Related Domain in TLS SNI (controlium .net) (hunting.rules)
  • 2072494 - ET HUNTING AdFection Related Domain in TLS SNI (powerium .net) (hunting.rules)
  • 2072495 - ET HUNTING AdFection Related Domain in TLS SNI (platc-tester .com) (hunting.rules)
  • 2072496 - ET HUNTING AdFection Related Domain in TLS SNI (myweb3id .io) (hunting.rules)
  • 2072497 - ET HUNTING AdFection Related Domain in TLS SNI (myipinfo .io) (hunting.rules)
  • 2072498 - ET HUNTING AdFection Related Domain in TLS SNI (akedo .gg) (hunting.rules)
  • 2072499 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (storage-files-api .workers .dev) (malware.rules)
  • 2072500 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (storage-files-api .workers .dev) (malware.rules)

Pro:

  • 2868820 - ETPRO MALWARE TA402 CnC Exfil Host Info M2 (malware.rules)
  • 2868821 - ETPRO MALWARE UNK_CashGrab Resource Request (malware.rules)
  • 2868822 - ETPRO MALWARE UNK_CashGrab Landing Page Observed (malware.rules)
  • 2868823 - ETPRO MALWARE UNK_CashGrab WebSockets Activity (malware.rules)
  • 2868824 - ETPRO MALWARE Observed DNS Query to UNK_CashGrab Domain (malware.rules)
  • 2868825 - ETPRO MALWARE Observed DNS Query to UNK_CashGrab Domain (malware.rules)
  • 2868826 - ETPRO WEB_SPECIFIC_APPS Microsoft Windows SharePoint Remote Code Execution via Workflow Compilation (CVE-2021-26420) (web_specific_apps.rules)
  • 2868827 - ETPRO MALWARE Observed UNK_CashGrab Domain in TLS SNI (malware.rules)
  • 2868828 - ETPRO MALWARE Observed UNK_CashGrab Domain in TLS SNI (malware.rules)
  • 2868829 - ETPRO WEB_SPECIFIC_APPS Advantech iView ConfigurationServlet SQL Injection via column_value (CVE-2023-3983) (web_specific_apps.rules)
  • 2868830 - ETPRO EXPLOIT_KIT DeviceCode PhishKit Landing Page Observed (exploit_kit.rules)
  • 2868831 - ETPRO EXPLOIT_KIT DeviceCode PhishKit Landing Page Observed (exploit_kit.rules)

Modified inactive rules:

  • 2868663 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)

Disabled and modified rules:

  • 2811577 - ETPRO MALWARE Possible Virut DGA NXDOMAIN Responses (com) (malware.rules)