Ruleset Update Summary - 2026/10/20 - v11315

Ruleset Updates
1

Summary:

13 new OPEN, 13 new PRO (13 + 0)

Added rules:

Open:

  • 2072517 - ET MALWARE Matanbuchus CnC Tunneling Activity, Session Established, * .microsoft .com variant (malware.rules)
  • 2072518 - ET MALWARE Matanbuchus CnC Tunneling Activity, DATA ACK (malware.rules)
  • 2072519 - ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, E Subdomain for Exfil (malware.rules)
  • 2072520 - ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, Terminate Tunnel (malware.rules)
  • 2072521 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (groks .workers .dev) (malware.rules)
  • 2072522 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (groks .workers .dev) (malware.rules)
  • 2072523 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (ssp-prod .joelbauertraining .com) (malware.rules)
  • 2072524 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (ssp-prod .joelbauertraining .com) (malware.rules)
  • 2072525 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rbmlh .xyz) (malware.rules)
  • 2072526 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rbmlh .xyz) in TLS SNI (malware.rules)
  • 2072527 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (siltapl .fun) (malware.rules)
  • 2072528 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (siltapl .fun) in TLS SNI (malware.rules)
  • 2072529 - ET HUNTING Apache CouchDB Erlang RPC OS Command (hunting.rules)

Modified inactive rules:

  • 2867062 - ETPRO WEB_SPECIFIC_APPS Adobe Coldfusion Central Config Server (CCS) Directory Traversal (CVE-2026-27305) (web_specific_apps.rules)