# Ruleset Update Summary - 2026/02/03 - v11117

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-03-v11117/3184>\
**Category:** Ruleset Updates\
**Created:** [February 3, 2026, 9:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-03-v11117/3184 "2026-02-03T21:53:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [February 3, 2026, 9:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-03-v11117/3184/1 "2026-02-03T21:53:53Z")

</div>

## Summary:

26 new OPEN, 39 new PRO (26 + 13)

* * *

## Added rules:

### Open:

- 2067266 - ET WEB\_SPECIFIC\_APPS SmarterTools SmarterMail ConnectToHub Unauthenticated Remote Code Execution (CVE-2026-24423) (web\_specific\_apps.rules)
- 2067267 - ET MALWARE PulsarRAT CnC Traffic Observed (malware.rules)
- 2067268 - ET INFO DYNAMIC\_DNS Query to a \*.dinprima .ro domain (info.rules)
- 2067269 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.dinprima .ro domain (info.rules)
- 2067270 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (monseftq .com) (exploit\_kit.rules)
- 2067271 - ET EXPLOIT\_KIT LandUpdate808 Domain (monseftq .com) in TLS SNI (exploit\_kit.rules)
- 2067272 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scarfkn .cyou) (malware.rules)
- 2067273 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (scarfkn .cyou) in TLS SNI (malware.rules)
- 2067274 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trainen .cyou) (malware.rules)
- 2067275 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trainen .cyou) in TLS SNI (malware.rules)
- 2067276 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (veinyjsuwk .site) (malware.rules)
- 2067277 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (veinyjsuwk .site) in TLS SNI (malware.rules)
- 2067278 - ET WEB\_SPECIFIC\_APPS FreePBX SSH testconnection Multiple Parameters Command Injection Attempt (CVE-2025-64328) (web\_specific\_apps.rules)
- 2067279 - ET MALWARE Cobalt Strike Related Domain in DNS Lookup (safe-dns .it .com) (malware.rules)
- 2067280 - ET MALWARE Cobalt Strike Related Domain in DNS Lookup (self-dns .it .com) (malware.rules)
- 2067281 - ET MALWARE Cobalt Strike Related Domain in DNS Lookup (cdncheck .it .com) (malware.rules)
- 2067282 - ET MALWARE Cobalt Strike Related Domain in TLS SNI (safe-dns .it .com) (malware.rules)
- 2067283 - ET MALWARE Cobalt Strike Related Domain in TLS SNI (self-dns .it .com) (malware.rules)
- 2067284 - ET MALWARE Cobalt Strike Related Domain in TLS SNI (cdncheck .it .com) (malware.rules)
- 2067285 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (payinty .com) (exploit\_kit.rules)
- 2067286 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (payinty .com) (exploit\_kit.rules)
- 2067287 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .cheriwildes .com) (malware.rules)
- 2067288 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (my .mikalprice .com) (malware.rules)
- 2067289 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .cheriwildes .com) (malware.rules)
- 2067290 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (my .mikalprice .com) (malware.rules)
- 2067291 - ET MALWARE Observed ClickFix Landing Page (malware.rules)

### Pro:

- 2865861 - ETPRO ATTACK\_RESPONSE Observed TA397 ClickFix Landing Page (attack\_response.rules)
- 2865862 - ETPRO ATTACK\_RESPONSE Observed TA397 ClickFix Landing Page (attack\_response.rules)
- 2865863 - ETPRO ATTACK\_RESPONSE TA397 CnC Activity (POST) (attack\_response.rules)
- 2865864 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2865865 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2865866 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2865867 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2865868 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2865869 - ETPRO MALWARE TA397 CnC Activity (GET) (malware.rules)
- 2865870 - ETPRO MALWARE Observed DNS Query to TA397 Domain (malware.rules)
- 2865871 - ETPRO MALWARE Observed TA397 Domain in TLS SNI (malware.rules)
- 2865872 - ETPRO EXPLOIT OpenSSL CMS AuthEnvelopedData AEAD IV Stack Overflow (CVE-2025-15467) M1 (exploit.rules)
- 2865873 - ETPRO EXPLOIT OpenSSL CMS AuthEnvelopedData AEAD IV Stack Overflow (CVE-2025-15467) M2 (exploit.rules)