Ruleset Update Summary - 2026/10/23 - v11318

Ruleset Updates
1

Summary:

8 new OPEN, 11 new PRO (8 + 3)

Thanks @trex_42

Added rules:

Open:

  • 2072562 - ET EXPLOIT Cisco Identity Services Engine API Gateway Authentication Bypass (CVE-2026-76460) (exploit.rules)
  • 2072563 - ET WEB_SPECIFIC_APPS Fortinet FortiSIEM gRPC phoenixSvc SendQueryResult query-id Header Path Traversal Attempt (CVE-2026-106173) (web_specific_apps.rules)
  • 2072564 - ET MALWARE Backdoored LiteLLM Package CnC Domain in DNS Lookup (litellm .dev) (malware.rules)
  • 2072565 - ET MALWARE Observed LiteLLM Backdoor Domain (litellm .dev in TLS SNI) (malware.rules)
  • 2072566 - ET MALWARE Malicious LiteLLM Exfil (litellm .dev) (malware.rules)
  • 2072567 - ET HUNTING Image Download From Dotted Quad Host via PowerShell (hunting.rules)
  • 2072568 - ET EXPLOIT_KIT Coruna EK Domain in DNS Lookup (xie .rpreh .com) (exploit_kit.rules)
  • 2072569 - ET EXPLOIT_KIT Coruna EK Domain in TLS SNI (xie .rpreh .com) (exploit_kit.rules)

Pro:

  • 2868903 - ETPRO WEB_SPECIFIC_APPS Apache Superset Default Secret Key Authentication Bypass (CVE-2023-27524) (web_specific_apps.rules)
  • 2868904 - ETPRO EXPLOIT MikroTik RouterOS SMB Buffer Overflow (CVE-2018-7445) (exploit.rules)
  • 2868905 - ETPRO WEB_CLIENT Adobe Flash Player Flash Parse Float Stack Buffer Overflow (CVE-2014-9163) (web_client.rules)