# Ruleset Update Summary - 2026/04/29 - v11182 **URL:** \ **Category:** Ruleset Updates\ **Created:** [April 29, 2026, 8:32pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-04-29-v11182/3275 "2026-04-29T20:32:48Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [April 29, 2026, 8:32pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-04-29-v11182/3275/1 "2026-04-29T20:32:48Z")
## Summary: 25 new OPEN, 53 new PRO (25 + 28) * * * ## Added rules: ### Open: - 2069054 - ET MALWARE Executable Downloaded From Common Payload Delivery Host (GET) (malware.rules) - 2069055 - ET MALWARE Executable Downloaded From Common Payload Delivery Host (GET) (malware.rules) - 2069056 - ET MALWARE Executable Downloaded From Common Payload Delivery Host (GET) (malware.rules) - 2069057 - ET MALWARE Executable Downloaded From Common Payload Delivery Host (GET) (malware.rules) - 2069058 - ET MALWARE Executable Downloaded From Common Payload Delivery Host (GET) (malware.rules) - 2069059 - ET HUNTING Amazon Cloudfront Geoblock Landing Page (hunting.rules) - 2069060 - ET WEB\_SPECIFIC\_APPS Apache HTTP Server Unauthenticated Arbitrary File Read via mod\_rewrite (CVE-2024-38475) (web\_specific\_apps.rules) - 2069061 - ET INFO DYNAMIC\_DNS Query to a \*.remotewire .net domain (info.rules) - 2069062 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.remotewire .net domain (info.rules) - 2069063 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (lyingapy .cyou) (malware.rules) - 2069064 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (lyingapy .cyou) in TLS SNI (malware.rules) - 2069065 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trotskxt .cyou) (malware.rules) - 2069066 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trotskxt .cyou) in TLS SNI (malware.rules) - 2069067 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (rapidlogiclab .top) (exploit\_kit.rules) - 2069068 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (rapidlogiclab .top) (exploit\_kit.rules) - 2069069 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (kovkcek .com) (exploit\_kit.rules) - 2069070 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (barsows .com) (exploit\_kit.rules) - 2069071 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (kovkcek .com) (exploit\_kit.rules) - 2069072 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (barsows .com) (exploit\_kit.rules) - 2069073 - ET MALWARE Observed DNS Query to Common Payload Delivery Domain (joyeriatauro .com) (malware.rules) - 2069074 - ET MALWARE Observed DNS Query to Common Payload Delivery Domain (mevetlab .cl) (malware.rules) - 2069075 - ET MALWARE Observed DNS Query to Common Payload Delivery Domain (bluebikinis .cl) (malware.rules) - 2069076 - ET MALWARE Observed Common Payload Delivery Domain (joyeriatauro .com in TLS SNI) (malware.rules) - 2069077 - ET MALWARE Observed Common Payload Delivery Domain (mevetlab .cl in TLS SNI) (malware.rules) - 2069078 - ET MALWARE Observed Common Payload Delivery Domain (bluebikinis .cl in TLS SNI) (malware.rules) ### Pro: - 2867359 - ETPRO EXPLOIT llama.cpp RPC Remote Code Execution via rpce\_tensor (CVE-2026-34159) (exploit.rules) - 2867360 - ETPRO WEB\_SPECIFIC\_APPS Handlebars.js AST Injection Remote Code Execution (CVE-2026-33937) (web\_specific\_apps.rules) - 2867361 - ETPRO WEB\_SPECIFIC\_APPS LiteLLM SQL Injection via Authentication Header (CVE-2026-42208) (web\_specific\_apps.rules) - 2867362 - ETPRO WEB\_SPECIFIC\_APPS Spring Framework Path Traversal via Jetty URI Parsing (CVE-2025-41242) (web\_specific\_apps.rules) - 2867363 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867364 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867365 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867366 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867367 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867368 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867369 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867370 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867371 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867372 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867373 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867374 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867375 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2867376 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867377 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2867378 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867379 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2867380 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867381 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867382 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2867383 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867384 - ETPRO WEB\_SPECIFIC\_APPS Metabase Authenticated Arbitrary File Write (CVE-2026-33725) (web\_specific\_apps.rules) - 2867385 - ETPRO MALWARE Arrhtymia Victim Heartbeat (POST) (malware.rules) - 2867386 - ETPRO MALWARE Arrhtymia Victim Heartbeat Headers Observed (malware.rules)