Ruleset Update Summary - 2026/10/22 - v11317

Ruleset Updates
1

Summary:

16 new OPEN, 20 new PRO (16 + 4)

Thanks @byrne_emmy12099, @fr0s7_

Added rules:

Open:

  • 2072546 - ET MALWARE NetSupport RAT CnC Domain in DNS Lookup (sendcarierpacket .com) (malware.rules)
  • 2072547 - ET MALWARE NetSupport RAT CnC Domain in TLS SNI (sendcarierpacket .com) (malware.rules)
  • 2072548 - ET EXPLOIT PHP php2shell Handler-mismatch Session Injection (CVE-2026-109619) (exploit.rules)
  • 2072549 - ET EXPLOIT PHP php2shell Multipart Header Amplification OOM (CVE-2026-109618) (exploit.rules)
  • 2072550 - ET EXPLOIT PHP php2shell Nested Empty File Control OOM (CVE-2026-109618) (exploit.rules)
  • 2072551 - ET EXPLOIT PHP php2shell Chunked Multipart Request without Content-Length (CVE-2026-109618) (exploit.rules)
  • 2072552 - ET EXPLOIT PHP php2shell Binary URL-Encoded POST for $_POST Corruption (CVE-2026-109618) (exploit.rules)
  • 2072553 - ET EXPLOIT PHP php2shell Multipart Request without Content-Length (CVE-2026-109618) (exploit.rules)
  • 2072554 - ET EXPLOIT PHP php2shell Code Injection in Filename (CVE-2026-109619) (exploit.rules)
  • 2072555 - ET HUNTING PHP Generic Upload Progress Session Manipulation (hunting.rules)
  • 2072556 - ET EXPLOIT PHP php2shell Excessive Multipart Part Count (CVE-2026-109618) (exploit.rules)
  • 2072557 - ET EXPLOIT PHP php2shell Excessive Empty Multipart File Controls (CVE-2026-109618) (exploit.rules)
  • 2072558 - ET WEB_SPECIFIC_APPS D-Link apply.cgi?formSystemCheck ipv4_ping Parameter Command Injection Attempt (CVE-2026-95675) (web_specific_apps.rules)
  • 2072559 - ET WEB_SPECIFIC_APPS D-Link DHMAPI SetTimeSettings NTPServer Parameter Command Injection Attempt (CVE-2026-93958) (web_specific_apps.rules)
  • 2072560 - ET MALWARE NetSupport RAT CnC Domain in DNS Lookup (transunionbiba .lat) (malware.rules)
  • 2072561 - ET MALWARE NetSupport RAT CnC Domain in TLS SNI (transunionbiba .lat) (malware.rules)

Pro:

  • 2868899 - ETPRO MALWARE NetSupport RAT CnC Host Exfil (malware.rules)
  • 2868900 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2868901 - ETPRO WEB_SPECIFIC_APPS VMware Aria Operations for Networks Authenticated Code Injection via exportPDF (CVE-2023-20889) (web_specific_apps.rules)
  • 2868902 - ETPRO EXPLOIT Apache HTTP Server mod_proxy HTTP Request Smuggling (CVE-2023-25690) (exploit.rules)