Ruleset Update Summary - 2026/11/03 - v11326

Ruleset Updates
1

Summary:

8 new OPEN, 18 new PRO (8 + 10)

Added rules:

Open:

  • 2072625 - ET EXPLOIT ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg) M2 (exploit.rules)
  • 2072626 - ET INFO DYNAMIC_DNS Query to a *.naughtybaptistbrewery .com domain (info.rules)
  • 2072627 - ET INFO DYNAMIC_DNS HTTP Request to a *.naughtybaptistbrewery .com domain (info.rules)
  • 2072628 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (brightqhorizons .cloud) (malware.rules)
  • 2072629 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (brightqhorizons .cloud) in TLS SNI (malware.rules)
  • 2072630 - ET WEB_SPECIFIC_APPS Zyxel logset.asp serverIP Parameter Command Injection Attempt (CVE-2017-18370) (web_specific_apps.rules)
  • 2072631 - ET WEB_SPECIFIC_APPS Zyxel tools_time.asp uiViewSNTPServer Parameter Command Injection Attempt (CVE-2017-18372) (web_specific_apps.rules)
  • 2072632 - ET WEB_SPECIFIC_APPS Zyxel adv_remotelog.asp syslogServerAddr Parameter Command Injection Attempt (CVE-2017-18369) (web_specific_apps.rules)

Pro:

  • 2869016 - ETPRO PHISHING Generic Phish Redirect Activity M1 (phishing.rules)
  • 2869017 - ETPRO PHISHING Generic Phish Redirect Activity M2 (phishing.rules)
  • 2869018 - ETPRO PHISHING Generic Phish CAPTCHA Verification Event (phishing.rules)
  • 2869019 - ETPRO PHISHING Generic Phish User Fingerprint Exfil (phishing.rules)
  • 2869020 - ETPRO PHISHING Generic Phish User Fingerprint Check (phishing.rules)
  • 2869021 - ETPRO PHISHING TA2730 Websocket Call M1 (phishing.rules)
  • 2869022 - ETPRO PHISHING TA2730 Websocket Call M2 (phishing.rules)
  • 2869023 - ETPRO EXPLOIT Google Chrome ANGLE and GPU Improper Input Validation Sandbox Escape (CVE-2025-6558) (exploit.rules)
  • 2869024 - ETPRO EXPLOIT CrushFTP AWS4-HMAC Authorization Authentication Bypass (CVE-2025-31161) (exploit.rules)
  • 2869025 - ETPRO MALWARE Generic Infostealer CnC Checkin (malware.rules)