# Ruleset Update Summary - 2026/02/12 - v11124 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 12, 2026, 9:47pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-12-v11124/3195 "2026-02-12T21:47:45Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 12, 2026, 9:47pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-12-v11124/3195/1 "2026-02-12T21:47:45Z")
## Summary: 15 new OPEN, 17 new PRO (15 + 2) * * * ## Added rules: ### Open: - 2067634 - ET INFO DYNAMIC\_DNS Query to a \*.rocketpride .com domain (info.rules) - 2067635 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.rocketpride .com domain (info.rules) - 2067636 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (netzhit .com) (exploit\_kit.rules) - 2067637 - ET EXPLOIT\_KIT LandUpdate808 Domain (netzhit .com) in TLS SNI (exploit\_kit.rules) - 2067638 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mixermixedo .click) (malware.rules) - 2067639 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mixermixedo .click) in TLS SNI (malware.rules) - 2067640 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (retiriu .cyou) (malware.rules) - 2067641 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (retiriu .cyou) in TLS SNI (malware.rules) - 2067642 - ET HUNTING HTTP Permissions-Policy Geolocation Directive (hunting.rules) - 2067643 - ET MALWARE Observed TinyNuke Payload Request (GET) (malware.rules) - 2067644 - ET MALWARE Observed StealC Payload Request (GET) (malware.rules) - 2067645 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (sonyj .com) (exploit\_kit.rules) - 2067646 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (sonyj .com) (exploit\_kit.rules) - 2067647 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (booking .lastminutebusinessclass .com) (malware.rules) - 2067648 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (booking .lastminutebusinessclass .com) (malware.rules) ### Pro: - 2866038 - ETPRO MALWARE Observed DNS Query to UNK\_MirageMaze Domain (malware.rules) - 2866039 - ETPRO MALWARE Observed UNK\_MirageMaze Domain in TLS SNI (malware.rules) * * * ## Modified inactive rules: - 2020581 - ET MALWARE Chanitor .onion Proxy Domain (malware.rules) - 2021063 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC) (malware.rules) - 2021702 - ET GAMES MINECRAFT Server response outbound (games.rules) - 2810754 - ETPRO MALWARE Trojan-Banker.Win32.Banbra.dou Checkin (malware.rules) - 2811656 - ETPRO EXPLOIT\_KIT SunDown EK Landing June 23 2015 (exploit\_kit.rules)