# Ruleset Update Summary - 2026/02/10 - v11122 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 10, 2026, 9:50pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-10-v11122/3193 "2026-02-10T21:50:58Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 10, 2026, 9:50pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-10-v11122/3193/1 "2026-02-10T21:50:58Z")
## Summary: 19 new OPEN, 32 new PRO (19 + 13) * * * ## Added rules: ### Open: - 2067417 - ET EXPLOIT Quest KACE Desktop Authority Insecure Named Pipe AdminExec Operation (CVE-2025-67813) (exploit.rules) - 2067418 - ET EXPLOIT Quest KACE Desktop Authority Insecure Named Pipe DllInjection Operation (CVE-2025-67813) (exploit.rules) - 2067419 - ET EXPLOIT Quest KACE Desktop Authority Insecure Named Pipe Credentials Operation (CVE-2025-67813) (exploit.rules) - 2067420 - ET EXPLOIT Quest KACE Desktop Authority Insecure Named Pipe ImpersonateAdmin Operation (CVE-2025-67813) (exploit.rules) - 2067421 - ET EXPLOIT Quest KACE Desktop Authority Insecure Named Pipe InvokeCOM Operation (CVE-2025-67813) (exploit.rules) - 2067440 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (investonline .in) (exploit\_kit.rules) - 2067441 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (investonline .in) (exploit\_kit.rules) - 2067442 - ET INFO DYNAMIC\_DNS Query to a \*.parcomunica .com domain (info.rules) - 2067443 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.parcomunica .com domain (info.rules) - 2067444 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (benecian .com) (exploit\_kit.rules) - 2067445 - ET EXPLOIT\_KIT LandUpdate808 Domain (benecian .com) in TLS SNI (exploit\_kit.rules) - 2067446 - ET WEB\_SPECIFIC\_APPS Roundcube Webmail SVG feImage Remote Image Bypass (CVE-2026-25916) (web\_specific\_apps.rules) - 2067447 - ET WEB\_CLIENT Evil Keitaro Set-Cookie Inbound (e3b0c4\_12) (web\_client.rules) - 2067448 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (retiroreturn .com) (exploit\_kit.rules) - 2067449 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (retiroreturn .com) (exploit\_kit.rules) - 2067450 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (events .youranokacounty .com) (malware.rules) - 2067451 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (infra .permianbuildersllc .com) (malware.rules) - 2067452 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (events .youranokacounty .com) (malware.rules) - 2067453 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (infra .permianbuildersllc .com) (malware.rules) ### Pro: - 2865992 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2865993 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2865994 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2865995 - ETPRO EXPLOIT Microsoft Shell Security Feature Bypass (CVE-2026-21510) M1 (exploit.rules) - 2865996 - ETPRO EXPLOIT Microsoft Shell Security Feature Bypass (CVE-2026-21510) M2 (exploit.rules) - 2865997 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M1 (exploit.rules) - 2865998 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M2 (exploit.rules) - 2865999 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M3 (exploit.rules) - 2866000 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M4 (exploit.rules) - 2866001 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M5 (exploit.rules) - 2866002 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M6 (exploit.rules) - 2866003 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M7 (exploit.rules) - 2866004 - ETPRO EXPLOIT Microsoft Outlook Spoofing (CVE-2026-21511) M8 (exploit.rules) * * * ## Modified inactive rules: - 2018622 - ET MALWARE Downloader.Win32.Tesch.A Bot Command (OK acknowledgement) (malware.rules) - 2808407 - ETPRO MOBILE\_MALWARE Android.Trojan.FakeInst.BX Checkin 2 (mobile\_malware.rules) * * * ## Removed rules: - 2067417 - ET INFO Quest KACE Desktop Authority Insecure Named Pipe AdminExec Operation (CVE-2025-67813) (info.rules) - 2067418 - ET INFO Quest KACE Desktop Authority Insecure Named Pipe DllInjection Operation (CVE-2025-67813) (info.rules) - 2067419 - ET INFO Quest KACE Desktop Authority Insecure Named Pipe Credentials Operation (CVE-2025-67813) (info.rules) - 2067420 - ET INFO Quest KACE Desktop Authority Insecure Named Pipe ImpersonateAdmin Operation (CVE-2025-67813) (info.rules) - 2067421 - ET INFO Quest KACE Desktop Authority Insecure Named Pipe InvokeCOM Operation (CVE-2025-67813) (info.rules)