Ruleset Update Summary - 2026/10/16 - v11313

Ruleset Updates
1

Summary:

6 new OPEN, 31 new PRO (6 + 25)

Added rules:

Open:

  • 2072501 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gloob .top) (malware.rules)
  • 2072502 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gloob .top) in TLS SNI (malware.rules)
  • 2072503 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (mini-kit .nashstuder .com) (malware.rules)
  • 2072504 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (embed-api .joelbaueronline .com) (malware.rules)
  • 2072505 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (mini-kit .nashstuder .com) (malware.rules)
  • 2072506 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (embed-api .joelbaueronline .com) (malware.rules)

Pro:

  • 2868832 - ETPRO WEB_SPECIFIC_APPS Advantech R-SeeNet Authenticated Arbitrary File Read (CVE-2023-3256) (web_specific_apps.rules)
  • 2868833 - ETPRO WEB_SPECIFIC_APPS Advantech iView NetworkServlet backupDatabase backup_filename Command Injection Parameter (CVE-2022-2143) (web_specific_apps.rules)
  • 2868834 - ETPRO WEB_SPECIFIC_APPS Advantech iView runProViewUpgrade fwfilename Command Injection (CVE-2022-2143) (web_specific_apps.rules)
  • 2868835 - ETPRO WEB_SPECIFIC_APPS AnythingLLM Unauthenticated API System Configuration Access (CVE-2026-24477, CVE-2024-6842) (web_specific_apps.rules)
  • 2868836 - ETPRO WEB_SPECIFIC_APPS AnythingLLM API Key Exposure Information Disclosure (CVE-2026-24477, CVE-2024-6842) (web_specific_apps.rules)
  • 2868837 - ETPRO WEB_SPECIFIC_APPS Apache OFBiz Authenticated Groovy RCE via traverseContent Service (CVE-2026-46586) (web_specific_apps.rules)
  • 2868838 - ETPRO WEB_SPECIFIC_APPS XWiki Platform Remote Code Execution (CVE-2025-24893) (web_specific_apps.rules)
  • 2868839 - ETPRO WEB_SPECIFIC_APPS Zoho ManageEngine Applications Manager SQL Injection (CVE-2024-5678) (web_specific_apps.rules)
  • 2868840 - ETPRO WEB_SPECIFIC_APPS Apache Kylin Arbitrary File Read (CVE-2025-61734) M1 (web_specific_apps.rules)
  • 2868841 - ETPRO WEB_SPECIFIC_APPS Apache Kylin Arbitrary File Read (CVE-2025-61734) M2 (web_specific_apps.rules)
  • 2868842 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868843 - ETPRO WEB_SPECIFIC_APPS Apache Kylin Server-Side Request Forgery (CVE-2025-61735) M1 (web_specific_apps.rules)
  • 2868844 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868845 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868846 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868847 - ETPRO WEB_SPECIFIC_APPS Apache Kylin Server-Side Request Forgery (CVE-2025-61735) M2 (web_specific_apps.rules)
  • 2868848 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868849 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868850 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868851 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868852 - ETPRO WEB_SPECIFIC_APPS Apache Kylin User Update Authentication Bypass (web_specific_apps.rules)
  • 2868853 - ETPRO WEB_SPECIFIC_APPS Apache Ofbiz Scrum Plugin RCE via SVN Argument Injection (CVE-2025-54466) (web_specific_apps.rules)
  • 2868854 - ETPRO WEB_SPECIFIC_APPS Apache OFBiz statsDecoratorLocation Server-Side Request Forgery (CVE-2024-45507) (web_specific_apps.rules)
  • 2868855 - ETPRO WEB_SPECIFIC_APPS Apache Traffic Control SQL Injection in deliveryservice_request_comments Endpoint (CVE-2024-45387) (web_specific_apps.rules)
  • 2868856 - ETPRO HUNTING ClickFix Related POST Activity (hunting.rules)