# Ruleset Update Summary - 2026/03/03 - v11138

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-03-v11138/3219>\
**Category:** Ruleset Updates\
**Created:** [March 3, 2026, 9:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-03-v11138/3219 "2026-03-03T21:38:55Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [March 3, 2026, 9:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-03-v11138/3219/1 "2026-03-03T21:38:55Z")

</div>

## Summary:

32 new OPEN, 46 new PRO (32 + 14)

* * *

## Added rules:

### Open:

- 2067969 - ET INFO DYNAMIC\_DNS Query to a \*.posambient .com domain (info.rules)
- 2067970 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.posambient .com domain (info.rules)
- 2067971 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (achandograca .com) (exploit\_kit.rules)
- 2067972 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (foodgefy .com) (exploit\_kit.rules)
- 2067973 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (medipeads .com) (exploit\_kit.rules)
- 2067974 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (nicorica .com) (exploit\_kit.rules)
- 2067975 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (stgbran .com) (exploit\_kit.rules)
- 2067976 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (wuliaox .com) (exploit\_kit.rules)
- 2067977 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (achandograca .com) (exploit\_kit.rules)
- 2067978 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (foodgefy .com) (exploit\_kit.rules)
- 2067979 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (medipeads .com) (exploit\_kit.rules)
- 2067980 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (nicorica .com) (exploit\_kit.rules)
- 2067981 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (stgbran .com) (exploit\_kit.rules)
- 2067982 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (wuliaox .com) (exploit\_kit.rules)
- 2067983 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (eshleytrei .top) (exploit\_kit.rules)
- 2067984 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (nonserest .top) (exploit\_kit.rules)
- 2067985 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (eshleytrei .top) (exploit\_kit.rules)
- 2067986 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (nonserest .top) (exploit\_kit.rules)
- 2067987 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (customer .grovecityroofing .com) (malware.rules)
- 2067988 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (devel .reputationreviews .org) (malware.rules)
- 2067989 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (feedback .grovecitypestcontrol .com) (malware.rules)
- 2067990 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (images .grovecityshoplocal .com) (malware.rules)
- 2067991 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (my .homesforsalegrovecityohio .com) (malware.rules)
- 2067992 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (customer .grovecityroofing .com) (malware.rules)
- 2067993 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (devel .reputationreviews .org) (malware.rules)
- 2067994 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (feedback .grovecitypestcontrol .com) (malware.rules)
- 2067995 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (images .grovecityshoplocal .com) (malware.rules)
- 2067996 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (my .homesforsalegrovecityohio .com) (malware.rules)
- 2067997 - ET WEB\_SPECIFIC\_APPS Juniper PTX Series On-Box Anomaly Detection Framwork Command Injection Attempt (CVE-2026-21902) M1 (web\_specific\_apps.rules)
- 2067998 - ET WEB\_SPECIFIC\_APPS Juniper PTX Series On-Box Anomaly Detection Framwork Command Injection Attempt (CVE-2026-21902) M2 (web\_specific\_apps.rules)
- 2067999 - ET WEB\_SPECIFIC\_APPS Juniper PTX Series On-Box Anomaly Detection Framwork Command Injection Attempt (CVE-2026-21902) M3 (web\_specific\_apps.rules)
- 2068000 - ET WEB\_SPECIFIC\_APPS Juniper PTX Series On-Box Anomaly Detection Framwork Command Injection Attempt (CVE-2026-21902) M4 (web\_specific\_apps.rules)

### Pro:

- 2866411 - ETPRO EXPLOIT Microsoft Windows LNK File UI Misrepresentation Remote Code Execution (CVE-2025-9491) M1 (exploit.rules)
- 2866412 - ETPRO EXPLOIT Microsoft Windows LNK File UI Misrepresentation Remote Code Execution (CVE-2025-9491) M2 (exploit.rules)
- 2866413 - ETPRO WEB\_SPECIFIC\_APPS SolarWinds WebHelpDesk Authentication Bypass (CVE-2025-40552) (web\_specific\_apps.rules)
- 2866414 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2866415 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2866416 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2866417 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2866418 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2866419 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2866420 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2866421 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2866422 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2866423 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2866424 - ETPRO WEB\_SPECIFIC\_APPS SolarWinds WebHelpDesk Remote Code Execution (CVE-2025-40553) (web\_specific\_apps.rules)