# Latest **URL:** https://community.emergingthreats.net/latest.md [Latest](https://community.emergingthreats.net/latest.md) · [Categories](https://community.emergingthreats.net/categories.md) · [Tags](https://community.emergingthreats.net/tags.md) --- ## [Ruleset Update Summary - 2026/09/22 - v11295](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-22-v11295/3460)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 22, 2026, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-22-v11295/3460 "2026-09-22T20:41:14Z")
Summary: 34 new OPEN, 40 new PRO (34 + 6) Thanks @skocherhan Added rules: Open: 2072125 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img2 .aixpirts .com) (malware.rules) 2072126 - ET MALWARE TA569 Gholoader… --- ## [SIGS: SloppyRAT](https://community.emergingthreats.net/t/sigs-sloppyrat/3451)
**Author:** [@kevross33](https://community.emergingthreats.net/u/kevross33)\ **Replies:** 2\ **Last updated:** [September 21, 2026, 8:49pm UTC](https://community.emergingthreats.net/t/sigs-sloppyrat/3451 "2026-09-21T20:49:16Z")
From SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz . UPDATE: I will keep these here in case but it does use certificate pinning likely making these unusable and having to fallback on encrypted traffic analyti… --- ## [Ruleset Update Summary - 2026/09/21 - v11294](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-21-v11294/3459)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 21, 2026, 7:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-21-v11294/3459 "2026-09-21T19:48:03Z")
Summary: 26 new OPEN, 31 new PRO (26 + 5) Added rules: Open: 2072099 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (mprevive .com) (malware.rules) 2072100 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (beta-into… --- ## [Ruleset Update Summary - 2026/09/18 - v11293](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-18-v11293/3458)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 18, 2026, 7:35pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-18-v11293/3458 "2026-09-18T19:35:59Z")
Summary: 9 new OPEN, 25 new PRO (9 + 16) Added rules: Open: 2072090 - ET MALWARE MakinoLoader CnC Checkin (malware.rules) 2072091 - ET MALWARE MakinoLoader CnC Checkin Response (malware.rules) 2072092 - ET MALWARE Mak… --- ## [Ruleset Update Summary - 2026/09/17 - v11292](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-17-v11292/3457)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 17, 2026, 9:03pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-17-v11292/3457 "2026-09-17T21:03:00Z")
Summary: 34 new OPEN, 81 new PRO (34 + 47) Added rules: Open: 2072056 - ET PHISHING Generic Phish Request to RMM M1 2026-09-16 (phishing.rules) 2072057 - ET PHISHING Generic Phish Request to RMM M2 2026-09-16 (phishin… --- ## [Ruleset Update Summary - 2026/09/16 - v11291](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-16-v11291/3456)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 16, 2026, 8:24pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-16-v11291/3456 "2026-09-16T20:24:06Z")
Summary: 6 new OPEN, 11 new PRO (6 + 5) Added rules: Open: 2072050 - ET WEB\_SPECIFIC\_APPS D-Link ve\_mgr.cgi f\_dev Parameter Command Injection Attempt (CVE-2026-82690) (web\_specific\_apps.rules) 2072051 - ET WEB\_SPECIFI… --- ## [Ruleset Update Summary - 2026/09/15 - v11290](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-15-v11290/3455)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 15, 2026, 8:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-15-v11290/3455 "2026-09-15T20:48:22Z")
Summary: 12 new OPEN, 15 new PRO (12 + 3) Added rules: Open: 2072038 - ET INFO Observed KingSoft Office Domain in DNS Lookup (ksord .com) (info.rules) 2072039 - ET INFO Observed KingSoft Office Domain in TLS SNI (ksor… --- ## [Ruleset Update Summary - 2026/09/14 - v11289](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-14-v11289/3454)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 14, 2026, 8:26pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-14-v11289/3454 "2026-09-14T20:26:29Z")
Summary: 20 new OPEN, 73 new PRO (20 + 53) Added rules: Open: 2072018 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (simesmile .xyz) (malware.rules) 2072019 - ET MALWARE Observed Win32/Lumma Steale… --- ## [Ruleset Update Summary - 2026/09/11 - v11288](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-11-v11288/3453)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 11, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-11-v11288/3453 "2026-09-11T20:40:09Z")
Summary: 22 new OPEN, 44 new PRO (22 + 22) Added rules: Open: 2071996 - ET MALWARE GemStone Gemini Chrome Extension CnC - Register (malware.rules) 2071997 - ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat … --- ## [Ruleset Update Summary - 2026/09/10 - v11287](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-10-v11287/3452)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-10-v11287/3452 "2026-09-10T20:40:23Z")
Summary: 13 new OPEN, 46 new PRO (13 + 33) Added rules: Open: 2012064 - ET RETIRED Foxit PDF Reader Title Stack Overflow (retired.rules) 2071984 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (regions .globalca… --- ## [Ruleset Update Summary - 2026/09/09 - v11286](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-09-v11286/3450)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 9, 2026, 8:30pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-09-v11286/3450 "2026-09-09T20:30:42Z")
Summary: 6 new OPEN, 15 new PRO (6 + 9) Added rules: Open: 2071978 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (claimpassivedebatw .pw) (malware.rules) 2071979 - ET MALWARE Observed Win32/Lumma S… --- ## [Ruleset Update Summary - 2026/09/08 - v11285](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-08-v11285/3449)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 8, 2026, 8:37pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-08-v11285/3449 "2026-09-08T20:37:20Z")
Summary: 30 new OPEN, 36 new PRO (30 + 6) Added rules: Open: 2071948 - ET INFO DYNAMIC\_DNS Query to a \*.ortodont-katalinic .com domain (info.rules) 2071949 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.ortodont-katalinic … --- ## [Ruleset Update Summary - 2026/09/07 - v11284](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11284/3448)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 6:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11284/3448 "2026-09-07T18:39:48Z")
Summary: 16 new OPEN, 16 new PRO (16 + 0) Added rules: Open: 2071932 - ET EXPLOIT\_KIT TA2727 Domain in DNS Lookup (muhefahuklodail .com) (exploit\_kit.rules) 2071933 - ET EXPLOIT\_KIT TA2727 Domain in DNS Lookup (api .k… --- ## [Ruleset Update Summary - 2026/09/07 - v11283](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11283/3447)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 4:01pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11283/3447 "2026-09-07T16:01:43Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2017940 - ET MALWARE Zbot Variant SSL cert for whoismama.ru (malware.rules) 2017941 - ET MALWARE Zbot Variant SSL cert for dewart.ru (malware.rules) 2017… --- ## [Ruleset Update Summary - 2026/09/07 - v11282](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11282/3446)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 2:31pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11282/3446 "2026-09-07T14:31:32Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2016142 - ET EXPLOIT\_KIT Sweet Orange Java payload request (2) (exploit\_kit.rules) 2016174 - ET EXPLOIT\_KIT DRIVEBY RedKit - Landing Page (exploit\_kit.ru… --- ## [Ruleset Update Summary - 2026/09/07 - v11281](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11281/3445)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 1:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11281/3445 "2026-09-07T13:41:46Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2014059 - ET ADWARE\_PUP Spyware.Agent.elbb lava.cn Game Exe Download (adware\_pup.rules) 2014066 - ET MALWARE Trojan-Clicker.Win32.VB.gnf Reporting (malwa… --- ## [Ruleset Update Summary - 2026/09/07 - v11280](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11280/3444)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 11:49am UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11280/3444 "2026-09-07T11:49:33Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2000026 - ET ADWARE\_PUP Gator Agent Traffic (adware\_pup.rules) 2000514 - ET ADWARE\_PUP IE homepage hijacking (adware\_pup.rules) 2000519 - ET ADWARE\_PUP s… --- ## [Ruleset Update Summary - 2026/09/07 - v11279](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11279/3443)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 11:11am UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11279/3443 "2026-09-07T11:11:35Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2000915 - ET ADWARE\_PUP WhenUClick.com Weather App Checkin (2) (adware\_pup.rules) 2000916 - ET ADWARE\_PUP WhenUClick.com WhenUSave App Checkin (adware\_pu… --- ## [Ruleset Update Summary - 2026/09/07 - v11278](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11278/3442)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 10:13am UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11278/3442 "2026-09-07T10:13:37Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2000006 - ET DOS Cisco Router HTTP DoS (dos.rules) 2000011 - ET DOS Catalyst memory leak attack (dos.rules) 2000025 - ET ADWARE\_PUP Gator Cookie (adware\_… --- ## [Ruleset Update Summary - 2026/09/07 - v11277](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11277/3441)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 8:31am UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11277/3441 "2026-09-07T08:31:52Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2001417 - ET ADWARE\_PUP E2give Related Receiving Config (adware\_pup.rules) 2001689 - ET WORM Potential MySQL bot scanning for SQL server (worm.rules) 200… --- ## [Ruleset Update Summary - 2026/09/07 - v11276](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11276/3440)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 7, 2026, 6:37am UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11276/3440 "2026-09-07T06:37:58Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2001116 - ET DNS Standard query response, Format error (dns.rules) 2001117 - ET DNS Standard query response, Name Error (dns.rules) 2001118 - ET DNS Stan… --- ## [Ruleset Update Summary - 2026/09/04 - v11275](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11275/3439)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 4, 2026, 6:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11275/3439 "2026-09-04T18:53:40Z")
Summary: 7 new OPEN, 7 new PRO (7 + 0) Added rules: Open: 2071925 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (st-dl .documentsupportservices .com) (malware.rules) 2071926 - ET MALWARE TA569 Gholoader CnC Do… --- ## [Ruleset Update Summary - 2026/09/04 - v11274](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11274/3438)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 4, 2026, 4:37pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11274/3438 "2026-09-04T16:37:11Z")
Summary: 0 new OPEN, 0 new PRO (0 + 0) Modified inactive rules: 2000342 - ET EXPLOIT Squid NTLM Auth Overflow Exploit (exploit.rules) 2000372 - ET EXPLOIT MS-SQL SQL Injection running SQL statements line comment (expl… --- ## [Ruleset Update Summary - 2026/09/03 - v11273](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-03-v11273/3437)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 3, 2026, 8:44pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-03-v11273/3437 "2026-09-03T20:44:49Z")
Summary: 8 new OPEN, 32 new PRO (8 + 24) Added rules: Open: 2071911 - ET MALWARE TonRAT CnC Request to TonAPI Dead Drop Resolver (malware.rules) 2071912 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (panel-api… --- ## [Ruleset Update Summary - 2026/09/02 - v11272](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-02-v11272/3436)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 2, 2026, 8:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-02-v11272/3436 "2026-09-02T20:51:01Z")
Summary: 24 new OPEN, 57 new PRO (24 + 33) Added rules: Open: 2071887 - ET WEB\_SPECIFIC\_APPS Spring Framework Functional Web Frameworks Path Traversal (CVE-2024-38819) (web\_specific\_apps.rules) 2071888 - ET INFO Obser… --- ## [Ruleset Update Summary - 2026/09/01 - v11271](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-01-v11271/3435)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 8:47pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-01-v11271/3435 "2026-09-01T20:47:31Z")
Summary: 17 new OPEN, 26 new PRO (17 + 9) Thanks @Cyderes Added rules: Open: 2071870 - ET MALWARE TonRAT CnC Activity (Fetch Powershell) (malware.rules) 2071871 - ET MALWARE TonRAT CnC Activity (Powershell Payload) (… --- ## [Ruleset Update Summary - 2026/08/31 - v11270](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-31-v11270/3434)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [August 31, 2026, 9:00pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-31-v11270/3434 "2026-08-31T21:00:08Z")
Summary: 37 new OPEN, 53 new PRO (37 + 16) Added rules: Open: 2001253 - ET RETIRED Yahoo IM successful logon (retired.rules) 2001254 - ET RETIRED Yahoo IM voicechat (retired.rules) 2001255 - ET RETIRED Yahoo IM ping (… --- ## [Ruleset Update Summary - 2026/08/28 - v11269](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-28-v11269/3433)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [August 28, 2026, 9:31pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-28-v11269/3433 "2026-08-28T21:31:23Z")
Summary: 16 new OPEN, 29 new PRO (16 + 13) Added rules: Open: 2071830 - ET INFO Microsoft Exchange Server MRSProxy NTLM Authentication (info.rules) 2071831 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lo… --- ## [Ruleset Update Summary - 2026/08/27 - v11268](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-27-v11268/3432)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [August 27, 2026, 9:08pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-27-v11268/3432 "2026-08-27T21:08:14Z")
Summary: 10 new OPEN, 10 new PRO (10 + 0) Added rules: Open: 2071820 - ET EXPLOIT Apache Log4j2 Issue #4255 FilteredObjectInputStream Allowlist Bypass via java.rmi.MarshalledObject (exploit.rules) 2071821 - ET HUNTING… --- ## [Ruleset Update Summary - 2026/08/26 - v11267](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-26-v11267/3431)
**Author:** [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Replies:** 0\ **Last updated:** [August 26, 2026, 8:55pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-26-v11267/3431 "2026-08-26T20:55:46Z")
Summary: 15 new OPEN, 34 new PRO (15 + 19) Added rules: Open: 2071805 - ET WEB\_SPECIFIC\_APPS Asus apply.cgi ca\_manage\_file\_name\_ca Parameter Directory Traversal Attempt (web\_specific\_apps.rules) 2071806 - ET WEB\_SPECI… [Next page](https://community.emergingthreats.net/latest.md?page=1)