Ruleset Update Summary - 2026/11/02 - v11325

Ruleset Updates
1

Summary:

13 new OPEN, 24 new PRO (13 + 11)

Added rules:

Open:

  • 2072612 - ET MALWARE Redhive Staging Domain in TLS SNI (gitrm .sbs) (malware.rules)
  • 2072613 - ET MALWARE Redhive Staging Domain in TLS SNI (gitsl .xyz) (malware.rules)
  • 2072614 - ET MALWARE Redhive Staging Domain in TLS SNI (gitview .sbs) (malware.rules)
  • 2072615 - ET MALWARE Redhive Staging Domain in TLS SNI (viewgit .sbs) (malware.rules)
  • 2072616 - ET INFO DYNAMIC_DNS Query to a *.chiemtinhviet .com domain (info.rules)
  • 2072617 - ET INFO DYNAMIC_DNS HTTP Request to a *.chiemtinhviet .com domain (info.rules)
  • 2072618 - ET INFO DYNAMIC_DNS Query to a *.9dejulio .gob .ar domain (info.rules)
  • 2072619 - ET INFO DYNAMIC_DNS HTTP Request to a *.9dejulio .gob .ar domain (info.rules)
  • 2072620 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rosaryconbo .fun) (malware.rules)
  • 2072621 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rosaryconbo .fun) in TLS SNI (malware.rules)
  • 2072622 - ET WEB_SPECIFIC_APPS Joomla Improper Access Control to Webservice Endpoints M2 (CVE-2023-23752) (web_specific_apps.rules)
  • 2072623 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (atl-ut .cannabisrootshub .com) (malware.rules)
  • 2072624 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (atl-ut .cannabisrootshub .com) (malware.rules)

Pro:

  • 2869005 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
  • 2869006 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
  • 2869007 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
  • 2869008 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
  • 2869009 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
  • 2869010 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
  • 2869011 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
  • 2869012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
  • 2869013 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
  • 2869014 - ETPRO MALWARE Hermes MaaS User-Agent Observed (malware.rules)
  • 2869015 - ETPRO MALWARE Hermes MaaS User-Agent Observed (malware.rules)

Disabled and modified rules:

  • 2868894 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (gitrm .cfd) (malware.rules)

Removed rules:

  • 2868896 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868897 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868898 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
  • 2868996 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (gitrm .sbs) (malware.rules)