# Ruleset Update Summary - 2026/02/13 - v11125 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 13, 2026, 9:57pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-13-v11125/3196 "2026-02-13T21:57:10Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 13, 2026, 9:57pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-02-13-v11125/3196/1 "2026-02-13T21:57:10Z")
## Summary: 33 new OPEN, 49 new PRO (33 + 16) Thanks @datadoghq, @suyog41, @watchtowrcyber * * * ## Added rules: ### Open: - 2067649 - ET MALWARE Observed MacOS ClickFix Landing Page (malware.rules) - 2067650 - ET MALWARE Observed MacOS ClickFix Landing Page (malware.rules) - 2067651 - ET MALWARE Observed MacOS ClickFix Landing Page (malware.rules) - 2067652 - ET MALWARE Observed MacOS ClickFix Landing Page (malware.rules) - 2067653 - ET MALWARE Observed MacOS ClickFix Landing Page (malware.rules) - 2067654 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (audioza .cyou) (malware.rules) - 2067655 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (audioza .cyou) in TLS SNI (malware.rules) - 2067656 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (notionz .qpon) (malware.rules) - 2067657 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (notionz .qpon) in TLS SNI (malware.rules) - 2067658 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (portuge .cyou) (malware.rules) - 2067659 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (portuge .cyou) in TLS SNI (malware.rules) - 2067660 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tothelo .cyou) (malware.rules) - 2067661 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tothelo .cyou) in TLS SNI (malware.rules) - 2067662 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (triniliu .cyou) (malware.rules) - 2067663 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (triniliu .cyou) in TLS SNI (malware.rules) - 2067664 - ET HUNTING Fake Github .com Html Footer (hunting.rules) - 2067665 - ET WEB\_SPECIFIC\_APPS Ivanti RemoteControlAuth logintype Parameter Authentication Bypass Attempt (CVE-2026-1603) (web\_specific\_apps.rules) - 2067666 - ET MALWARE Observed DNS Query to MacSync Stealer Domain (frozendoome .com) (malware.rules) - 2067667 - ET MALWARE Observed DNS Query to MacSync Stealer Domain (airportsock .xyz) (malware.rules) - 2067668 - ET MALWARE Observed DNS Query to MacSync Stealer Domain (securityfenceandwelding .com) (malware.rules) - 2067669 - ET MALWARE Observed DNS Query to MacSync Stealer Domain (primedatahost4 .lol) (malware.rules) - 2067670 - ET MALWARE Observed MacSync Stealer Domain (frozendoome .com in TLS SNI) (malware.rules) - 2067671 - ET MALWARE Observed MacSync Stealer Domain (airportsock .xyz in TLS SNI) (malware.rules) - 2067672 - ET MALWARE Observed MacSync Stealer Domain (securityfenceandwelding .com in TLS SNI) (malware.rules) - 2067673 - ET MALWARE Observed MacSync Stealer Domain (primedatahost4 .lol in TLS SNI) (malware.rules) - 2067674 - ET MALWARE MacSync Stage 1 Payload Request (malware.rules) - 2067675 - ET MALWARE MacSync Stage 2 CnC Exfil (malware.rules) - 2067676 - ET MALWARE SHubv2.0 CnC Heartbeat (malware.rules) - 2067677 - ET MALWARE Observed DNS Query to SHubv2.0 Domain (imper-strlk5 .com) (malware.rules) - 2067678 - ET MALWARE Observed SHubv2.0 Domain (imper-strlk5 .com in TLS SNI) (malware.rules) - 2067679 - ET HUNTING HTTP Permissions-Policy Geolocation Directive Misconfiguration (hunting.rules) - 2067680 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (booking .lastminutebusinessclass .com) (malware.rules) - 2067681 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (booking .lastminutebusinessclass .com) (malware.rules) ### Pro: - 2866040 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2866041 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2866042 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2866043 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2866044 - ETPRO PHISHING TA453 Domain in TLS SNI (phishing.rules) - 2866045 - ETPRO PHISHING TA453 Domain in TLS SNI (phishing.rules) - 2866046 - ETPRO PHISHING TA453 Domain in TLS SNI (phishing.rules) - 2866047 - ETPRO PHISHING TA453 Domain in TLS SNI (phishing.rules) - 2866048 - ETPRO PHISHING TA543 Phish Kit Fingerprinting User (phishing.rules) - 2866049 - ETPRO PHISHING TA453 Phish Landing Page 2026-02-12 (phishing.rules) - 2866050 - ETPRO PHISHING TA543 Phish Kit Checkin (phishing.rules) - 2866051 - ETPRO PHISHING TA543 Phish Kit Find User (phishing.rules) - 2866052 - ETPRO PHISHING TA543 Successful Credential Phish (phishing.rules) - 2866053 - ETPRO PHISHING TA453 User Fingerprint Exfil (phishing.rules) - 2866054 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2866056 - ETPRO PHISHING TA453 Landing Page 2026-02-13 (phishing.rules) * * * ## Modified inactive rules: - 2022078 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM) (malware.rules) - 2022227 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (FindPOS CnC) (malware.rules) - 2022512 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC) (malware.rules) - 2022612 - ET MALWARE Scarlet Mimic DNS Lookup 47 (malware.rules) - 2813035 - ETPRO MALWARE Rovnix DNS Lookup (zeleniypoyas.su) (malware.rules) - 2815425 - ETPRO MALWARE Malicious SSL certificate detected (Ursnif CnC) (malware.rules) - 2815850 - ETPRO MOBILE\_MALWARE Android.Trojan.Tefoni.A Checkin (mobile\_malware.rules) * * * ## Disabled and modified rules: - 2067642 - ET HUNTING HTTP Permissions-Policy Geolocation Directive (hunting.rules)