# Ruleset Update Summary - 2026/03/09 - v11142 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-09-v11142/3224 **Category:** Ruleset Updates **Created:** [March 9, 2026, 8:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-09-v11142/3224 "2026-03-09T20:25:47Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [March 9, 2026, 8:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-09-v11142/3224/1 "2026-03-09T20:25:47Z")
## Summary: 33 new OPEN, 34 new PRO (33 + 1) Thanks @g0njxa * * * ## Added rules: ### Open: - 2068060 - ET INFO DYNAMIC\_DNS Query to a \*.christianfaure .com domain (info.rules) - 2068061 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.christianfaure .com domain (info.rules) - 2068062 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (captaid .cyou) (malware.rules) - 2068063 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (captaid .cyou) in TLS SNI (malware.rules) - 2068064 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (croprojegies .run) (malware.rules) - 2068065 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (croprojegies .run) in TLS SNI (malware.rules) - 2068066 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pinkipinevazzey .pw) (malware.rules) - 2068067 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pinkipinevazzey .pw) in TLS SNI (malware.rules) - 2068068 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (superyupp .fun) (malware.rules) - 2068069 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (superyupp .fun) in TLS SNI (malware.rules) - 2068070 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (youngjo .cyou) (malware.rules) - 2068071 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (youngjo .cyou) in TLS SNI (malware.rules) - 2068072 - ET INFO DYNAMIC\_DNS Query to a \*.hndifhidalgo .gob .mx domain (info.rules) - 2068073 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.hndifhidalgo .gob .mx domain (info.rules) - 2068074 - ET INFO DYNAMIC\_DNS Query to a \*.lauriemillotte .com domain (info.rules) - 2068075 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.lauriemillotte .com domain (info.rules) - 2068076 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sausagenighte .online) (malware.rules) - 2068077 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sausagenighte .online) in TLS SNI (malware.rules) - 2068078 - ET MALWARE Observed MeshCentral RMM Admin Panel (malware.rules) - 2068079 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (files .jeaniescott .digital) (malware.rules) - 2068080 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (files .jeaniescott .digital) (malware.rules) - 2068081 - ET MALWARE Observed DNS Query to RMM Payload Delivery Domain (vmware-vsphere .com) (malware.rules) - 2068082 - ET MALWARE Observed DNS Query to RMM Payload Delivery Domain (vmware-repository .com) (malware.rules) - 2068083 - ET MALWARE Observed RMM Payload Delivery Domain (vmware-vsphere .com in TLS SNI) (malware.rules) - 2068084 - ET MALWARE Observed RMM Payload Delivery Domain (vmware-repository .com in TLS SNI) (malware.rules) - 2068085 - ET EXPLOIT\_KIT Coruna Loader Page (exploit\_kit.rules) - 2068086 - ET INFO DYNAMIC\_DNS Query to a \*.fauxmacho .com domain (info.rules) - 2068087 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.fauxmacho .com domain (info.rules) - 2068088 - ET EXPLOIT\_KIT Coruna Device Fingerprinting M1 (exploit\_kit.rules) - 2068089 - ET EXPLOIT\_KIT Coruna Device Fingerprinting M2 (exploit\_kit.rules) - 2068090 - ET EXPLOIT\_KIT Coruna Device Fingerprinting M3 (exploit\_kit.rules) - 2068091 - ET EXPLOIT\_KIT Coruna Device Fingerprinting M4 (exploit\_kit.rules) - 2068092 - ET EXPLOIT\_KIT Coruna Device Fingerprinting M5 (exploit\_kit.rules) ### Pro: - 2866490 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) * * * ## Modified inactive rules: - 2002182 - ET EXPLOIT Backup Exec Windows Agent Remote File Access - Vulnerable (exploit.rules) - 2002316 - ET EXPLOIT Outgoing Electronic Mail for UNIX Expires Header Buffer Overflow Exploit (exploit.rules) - 2002722 - ET POLICY MP3 File Transfer Outbound (policy.rules) - 2003323 - ET P2P Edonkey Client to Server Hello (p2p.rules) - 2008742 - ET ADWARE\_PUP Admoke/Adload.AFB!tr.dldr Checkin (adware\_pup.rules) - 2024079 - ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gozi MITM) (malware.rules) - 2820621 - ETPRO EXPLOIT Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution CVE (CVE-2009-1429) (exploit.rules) - 2821053 - ETPRO MALWARE Malicious SSL certificate detected (Malware C2) (malware.rules) - 2825849 - ETPRO WEB\_CLIENT Possible IE UAF (CVE-2017-0158) (web\_client.rules) - 2826058 - ETPRO MALWARE ZLoader Malicious SSL Cert Observed (malware.rules)