Ruleset Update Summary - 2026/11/04 - v11327

Ruleset Updates
1

Summary:

6 new OPEN, 15 new PRO (6 + 9)

Added rules:

Open:

  • 2072633 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-connects .com) (malware.rules)
  • 2072634 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-cf .workersp .dev) (malware.rules)
  • 2072635 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-connects .com) (malware.rules)
  • 2072636 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-cf .workersp .dev) (malware.rules)
  • 2072637 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img3 .centovinipolska .com) (malware.rules)
  • 2072638 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img3 .centovinipolska .com) (malware.rules)

Pro:

  • 2869026 - ETPRO EXPLOIT Quest KACE System Management Appliance Unauthenticated Command Injection (CVE-2018-11138) (exploit.rules)
  • 2869027 - ETPRO EXPLOIT Quest KACE System Management Appliance Authenticated Command Injection (CVE-2018-11139) (exploit.rules)
  • 2869028 - ETPRO EXPLOIT Quest KACE System Management Appliance Authentication Bypass (CVE-2018-11142) M1 (exploit.rules)
  • 2869029 - ETPRO EXPLOIT Quest KACE System Management Appliance Authentication Bypass (CVE-2018-11142) M2 (exploit.rules)
  • 2869030 - ETPRO HUNTING SAP Solution Manager (SolMan) Vulnerable Server Probe (CVE-2020-6207) (hunting.rules)
  • 2869031 - ETPRO EXPLOIT SAP Solution Manager (SolMan) Server-side Request Forgery (CVE-2020-6207) (exploit.rules)
  • 2869032 - ETPRO HUNTING WEBP VP8L Suspicious Padding M1 (hunting.rules)
  • 2869033 - ETPRO HUNTING WEBP VP8L Suspicious Padding M2 (hunting.rules)
  • 2869034 - ETPRO MALWARE Grandoreiro CnC Activity (GET) (malware.rules)