Ruleset Update Summary - 2026/10/19 - v11314

Ruleset Updates
1

Summary:

9 new OPEN, 38 new PRO (9 + 29)

Added rules:

Open:

  • 2072507 - ET EXPLOIT_KIT ClickFix Domain in DNS Lookup (treboarkez .lol) (exploit_kit.rules)
  • 2072508 - ET EXPLOIT_KIT ClickFix Domain in TLS SNI (treboarkez .lol) (exploit_kit.rules)
  • 2072509 - ET WEB_SPECIFIC_APPS Plex Media Server Plex2Shell Unauthenticated Server-Side Request Forgery (CVE-2026-96652) (web_specific_apps.rules)
  • 2072510 - ET WEB_SPECIFIC_APPS Plex Media Server Plex2Shell URL Injection via searchOne (CVE-2026-96654) (web_specific_apps.rules)
  • 2072511 - ET WEB_SPECIFIC_APPS Plex Media Server Plex2Shell Authenticated Arbitrary File Write (CVE-2026-96655) M1 (web_specific_apps.rules)
  • 2072512 - ET WEB_SPECIFIC_APPS Plex Media Server Plex2Shell Authenticated Arbitrary File Write (CVE-2026-96655) M2 (web_specific_apps.rules)
  • 2072513 - ET WEB_SPECIFIC_APPS Plex Media Server Plex2Shell Authenticated Server-Side Request Forgery (CVE-2026-96655) (web_specific_apps.rules)
  • 2072515 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brightfutuxres .tech) (malware.rules)
  • 2072516 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brightfutuxres .tech) in TLS SNI (malware.rules)

Pro:

  • 2868857 - ETPRO MALWARE ClickFix CnC Checkin Activity (malware.rules)
  • 2868858 - ETPRO MALWARE ClickFix Filter Activity (malware.rules)
  • 2868859 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868860 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868861 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868862 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868863 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868864 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868865 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868866 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868867 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2868868 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2868869 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2868870 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2868871 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2868872 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2868873 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2868874 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2868875 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868876 - ETPRO MALWARE LunexStealer Remote Conifg Request (malware.rules)
  • 2868877 - ETPRO MALWARE LunexStealer CnC Config Inbound (malware.rules)
  • 2868878 - ETPRO MALWARE LunexStealer Bot Registration (malware.rules)
  • 2868879 - ETPRO MALWARE LunexStealer CnC Bot Registration Status (malware.rules)
  • 2868880 - ETPRO MALWARE LunexStealer Passwords Exfil (malware.rules)
  • 2868881 - ETPRO MALWARE LunexStealer Tokens Exfil (malware.rules)
  • 2868882 - ETPRO MALWARE LunexStealer Wallets Exfil (malware.rules)
  • 2868883 - ETPRO MALWARE LunexStealer Victim Task Polling (malware.rules)
  • 2868884 - ETPRO MALWARE LunexStealer CnC Task Polling Response (malware.rules)
  • 2868885 - ETPRO MALWARE LunexStealer Victim Task Acknowledgment (malware.rules)