Ruleset Update Summary - 2026/10/26 - v11319

Ruleset Updates
1

Summary:

8 new OPEN, 37 new PRO (8 + 29)

Added rules:

Open:

  • 2072570 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (makketakecoincidejs .shop) (malware.rules)
  • 2072571 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (makketakecoincidejs .shop) in TLS SNI (malware.rules)
  • 2072572 - ET WEB_SPECIFIC_APPS Jenkins Groovy Plugin Authenticated Remote Command Execution (CVE-2019-1003030) (web_specific_apps.rules)
  • 2072573 - ET WEB_SERVER Oracle WebLogic Server Directory Traversal (CVE-2020-14750) (web_server.rules)
  • 2072574 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (firebase .emeraldpineventuresllc .com) (malware.rules)
  • 2072575 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (firebase .emeraldpineventuresllc .com) (malware.rules)
  • 2072576 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (ekkov .workers .dev) (malware.rules)
  • 2072577 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (ekkov .workers .dev) (malware.rules)

Pro:

  • 2868906 - ETPRO EXPLOIT_KIT CorunaEK Cookie M1 (exploit_kit.rules)
  • 2868907 - ETPRO EXPLOIT_KIT CorunaEK Cookie M2 (exploit_kit.rules)
  • 2868908 - ETPRO EXPLOIT_KIT CorunaEK Logging Auth Attempts (exploit_kit.rules)
  • 2868909 - ETPRO EXPLOIT_KIT CorunaEK Landing Page M1 (exploit_kit.rules)
  • 2868910 - ETPRO EXPLOIT_KIT CorunaEK Landing Page M2 (exploit_kit.rules)
  • 2868911 - ETPRO WEB_SERVER Apache Struts2 ConversionErrorInterceptor OGNL Script Injection (CVE-2012-0391) (web_server.rules)
  • 2868912 - ETPRO EXPLOIT Gogs PutContents API Symbolic Link Path Traversal (CVE-2025-8110) (exploit.rules)
  • 2868913 - ETPRO INFO Microsoft Support Diagnostic Tool Configuration File Download (info.rules)
  • 2868914 - ETPRO EXPLOIT Microsoft Support Diagnostic Tool Dogwalk Remote Code Injection (CVE-2022-34713) (exploit.rules)
  • 2868915 - ETPRO EXPLOIT TP-Link Archer Multiple Devices Directory Traversal (CVE-2015-3035) (exploit.rules)
  • 2868916 - ETPRO EXPLOIT Oracle Business Intelligence Enterprise Edition getPreviewImage Directory Traversal (CVE-2020-14864) (exploit.rules)
  • 2868917 - ETPRO EXPLOIT ZKTeco BioTime iclock Path Traversal (CVE-2023-38950) (exploit.rules)
  • 2868918 - ETPRO WEB_SPECIFIC_APPS Vite Vitejs import query Improper Access Control (CVE-2025-31125) (web_specific_apps.rules)
  • 2868919 - ETPRO EXPLOIT Zabbix Server Frontend Improper Access Control (CVE-2022-23134) (exploit.rules)
  • 2868920 - ETPRO EXPLOIT Versa Concerto Actuator Endpoint Authentication Bypass (CVE-2025-34026) (exploit.rules)
  • 2868921 - ETPRO EXPLOIT Versa Concerto API Path Authentication Bypass (CVE-2025-34027) (exploit.rules)
  • 2868922 - ETPRO EXPLOIT TP-Link TL-WA855RE V5_200415 Device Reset Authentication Bypass (CVE-2020-24363) (exploit.rules)
  • 2868923 - ETPRO EXPLOIT Sumavision Enhanced Multimedia Router formEMR30 Cross-Site Request Forgery (CVE-2020-10181) (exploit.rules)
  • 2868924 - ETPRO WEB_SPECIFIC_APPS Yii Framework Behavior Attachment via __class key Remote Code Exeution (CVE-2024-58136) (web_specific_apps.rules)
  • 2868925 - ETPRO EXPLOIT SolarWinds Web Help Desk AjaxProxy Insecure Deserialization (CVE-2024-28986) (exploit.rules)
  • 2868926 - ETPRO EXPLOIT SolarWinds Web Help Desk AjaxProxy Insecure Deserialization (CVE-2025-26399) (exploit.rules)
  • 2868927 - ETPRO MALWARE TryNodeRAT CnC Fetch Payload M1 (malware.rules)
  • 2868928 - ETPRO WEB_SPECIFIC_APPS Kentico Unauthenticated Remote Code Execution via Insecure Dot Net Deserialization (CVE-2019-10068) (web_specific_apps.rules)
  • 2868929 - ETPRO EXPLOIT Oracle ADF Deserialization Remote Code Execution (CVE-2022-21445) (exploit.rules)
  • 2868930 - ETPRO WEB_SPECIFIC_APPS Plex Media Server Authenticated unpickle Dict Insecure Deserialization (CVE-2020-5741) (web_specific_apps.rules)
  • 2868931 - ETPRO MALWARE TryNodeRAT Victim Registration (malware.rules)
  • 2868932 - ETPRO MALWARE TryNodeRAT Victim Registration CnC Response (malware.rules)
  • 2868933 - ETPRO MALWARE TryNodeRAT CnC HeartBeat Victim Response (malware.rules)
  • 2868934 - ETPRO MALWARE TryNodeRAT CnC HeartBeat Inbound (malware.rules)