Ruleset Update Summary - 2026/10/21 - v11316

Ruleset Updates
1

Summary:

21 new OPEN, 34 new PRO (21 + 13)

Added rules:

Open:

  • 2048584 - ET MALWARE BadCandy Cisco IOS XE Implant Check-in (malware.rules)
  • 2048934 - ET MALWARE BadCandy Cisco IOS XE Implant Local Account (cisco_support) (malware.rules)
  • 2048938 - ET MALWARE BadCandy Cisco IOS XE Implant Local Account (cisco_tac_admin) (malware.rules)
  • 2048943 - ET EXPLOIT Cisco IOS XE Web Server execCLI in SOAP (CVE-2023-20198) (exploit.rules)
  • 2048945 - ET EXPLOIT Cisco IOS XE Web UI Privilege Escalation (CVE-2023-20198) (exploit.rules)
  • 2072530 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (player-js .joelbauer .com) (malware.rules)
  • 2072531 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (player-js .joelbauer .com) (malware.rules)
  • 2072532 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (storagebase .workers .dev) (malware.rules)
  • 2072533 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (storagebase .workers .dev) (malware.rules)
  • 2072534 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (boarderryowk .shop) (malware.rules)
  • 2072535 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (boarderryowk .shop) in TLS SNI (malware.rules)
  • 2072536 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadeclosedrespecttedyw .pw) (malware.rules)
  • 2072537 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fadeclosedrespecttedyw .pw) in TLS SNI (malware.rules)
  • 2072538 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (peansopk .live) (malware.rules)
  • 2072539 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (peansopk .live) in TLS SNI (malware.rules)
  • 2072540 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ptramidermsnqj .shop) (malware.rules)
  • 2072541 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ptramidermsnqj .shop) in TLS SNI (malware.rules)
  • 2072542 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trickysymptommysqu .xyz) (malware.rules)
  • 2072543 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trickysymptommysqu .xyz) in TLS SNI (malware.rules)
  • 2072544 - ET MALWARE Kumsuky Related Victim Exfil (malware.rules)
  • 2072545 - ET HUNTING GET Request to Filename aes.js (hunting.rules)

Pro:

  • 2868886 - ETPRO MALWARE Cloudflare Hosted PowerShell to Execute Python Payloads (malware.rules)
  • 2868887 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (malware.rules)
  • 2868888 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (malware.rules)
  • 2868889 - ETPRO MALWARE TryNodeRAT CnC Domain in TLS SNI (malware.rules)
  • 2868890 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (malware.rules)
  • 2868891 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (malware.rules)
  • 2868892 - ETPRO MALWARE TryNodeRAT CnC Domain in DNS Lookup (malware.rules)
  • 2868893 - ETPRO HUNTING Redhive Domain Structure (hunting.rules)
  • 2868894 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868895 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868896 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868897 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868898 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)

Modified inactive rules:

  • 2868654 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)

Disabled and modified rules:

  • 2048935 - ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_support) (CVE-2023-20198) (Outbound) (info.rules)
  • 2048939 - ET HUNTING Cisco IOS XE Web Server Auth From Suspicious Username (cisco_tac_admin) (CVE-2023-20198) (Outbound) (hunting.rules)
  • 2048940 - ET EXPLOIT Cisco IOS XE Web Server Possible Authentication Bypass Attempt (CVE-2023-20198) (Outbound) (exploit.rules)
  • 2048942 - ET INFO Cisco IOS XE Web Server execCLI in SOAP (CVE-2023-20198) (Outbound) (info.rules)
  • 2048944 - ET INFO Cisco IOS XE Web Server Config Change in SOAP (CVE-2023-20198) (Outbound) (info.rules)
  • 2049103 - ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) M3 (exploit.rules)

Removed rules:

  • 2048583 - ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Outbound) M1 (exploit.rules)
  • 2048584 - ET EXPLOIT Cisco IOS XE Web Server Implant Check (CVE-2023-20198) (Inbound) M1 (exploit.rules)
  • 2048934 - ET INFO Cisco IOS XE Web Server Auth From Suspicious Username (cisco_support) (CVE-2023-20198) (Inbound) (info.rules)
  • 2048938 - ET HUNTING Cisco IOS XE Web Server Auth From Suspicious Username (cisco_tac_admin) (CVE-2023-20198) (Inbound) (hunting.rules)
  • 2048943 - ET INFO Cisco IOS XE Web Server execCLI in SOAP (CVE-2023-20198) (Inbound) (info.rules)
  • 2048945 - ET INFO Cisco IOS XE Web Server Config Change in SOAP (CVE-2023-20198) (Inbound) (info.rules)