# Ruleset Update Summary - 2026/02/05 - v11119 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 5, 2026, 9:59pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-05-v11119/3189 "2026-02-05T21:59:49Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 5, 2026, 9:59pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-05-v11119/3189/1 "2026-02-05T21:59:49Z")
## Summary: 24 new OPEN, 25 new PRO (24 + 1) * * * ## Added rules: ### Open: - 2067327 - ET PHISHING CoGUI 404 Response 2026-02-04 (phishing.rules) - 2067328 - ET PHISHING CoGUI Response Page 2026-02-04 (phishing.rules) - 2067329 - ET INFO DYNAMIC\_DNS Query to a \*.rinet .ai domain (info.rules) - 2067330 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.rinet .ai domain (info.rules) - 2067331 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (weibast .com) (exploit\_kit.rules) - 2067332 - ET EXPLOIT\_KIT LandUpdate808 Domain (weibast .com) in TLS SNI (exploit\_kit.rules) - 2067333 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (troyouc .cyou) (malware.rules) - 2067334 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (troyouc .cyou) in TLS SNI (malware.rules) - 2067335 - ET MALWARE DesckVB RAT CnC Checkin (malware.rules) - 2067336 - ET MALWARE DesckVB RAT RunBlugin Response from CnC (malware.rules) - 2067337 - ET PHISHING Generic Crypto Phish Landing Page M1 2026-02-05 (phishing.rules) - 2067338 - ET PHISHING Generic Crypto Phish Landing Page M2 2026-02-05 (phishing.rules) - 2067339 - ET MALWARE DesckVB RAT DetectaAV Checkin (malware.rules) - 2067340 - ET MALWARE DesckVB RAT Ping Checkin (malware.rules) - 2067341 - ET MALWARE DesckVB RAT BlugPass Checkin (malware.rules) - 2067342 - ET PHISHING Successful Generic Crypto Phish Exfil M1 2026-02-05 (phishing.rules) - 2067343 - ET MALWARE DesckVB RAT BlugPass Checkin - Webcam Enumeration (malware.rules) - 2067344 - ET PHISHING Successful Generic Crypto Phish Exfil M2 2026-02-05 (phishing.rules) - 2067345 - ET MALWARE DesckVB RAT D ping request/response (malware.rules) - 2067346 - ET WEB\_SPECIFIC\_APPS Arista runTroubleshooting HOST Parameter Command Injection Attempt (CVE-2025-6978) (web\_specific\_apps.rules) - 2067347 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (madridherb .com) (exploit\_kit.rules) - 2067348 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (madridherb .com) (exploit\_kit.rules) - 2067349 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (app .envisionoptical .com) (malware.rules) - 2067350 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (app .envisionoptical .com) (malware.rules) ### Pro: - 2865922 - ETPRO WEB\_SPECIFIC\_APPS Apache bRPC profiling Unauthenticated Remote Code Execution (CVE-2025-60021) (web\_specific\_apps.rules)