# Ruleset Update Summary - 2026/05/05 - v11186 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-05-05-v11186/3279 **Category:** Ruleset Updates **Created:** [May 5, 2026, 8:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-05-05-v11186/3279 "2026-05-05T20:25:11Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [May 5, 2026, 8:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-05-05-v11186/3279/1 "2026-05-05T20:25:11Z")
## Summary: 7 new OPEN, 9 new PRO (7 + 2) * * * ## Added rules: ### Open: - 2069165 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (images .tippytoespreschoolva .com) (malware.rules) - 2069166 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (images .tippytoespreschoolva .com) (malware.rules) - 2069167 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fourdigs .cyou) (malware.rules) - 2069168 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fourdigs .cyou) in TLS SNI (malware.rules) - 2069169 - ET MALWARE MaskGramStealer CnC Checkin (GET) (malware.rules) - 2069170 - ET MALWARE MaskGramStealer Encrypted Data Inbound (malware.rules) - 2069171 - ET WEB\_SERVER Cisco IOS Authenticated SNMP Remote Code Execution (CVE-2025-20352) (web\_server.rules) ### Pro: - 2867427 - ETPRO WEB\_SPECIFIC\_APPS Sawtooth Software Lighthouse Studio Template Injection via ciwweb.pl (CVE-2025-34300) (web\_specific\_apps.rules) - 2867429 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)