# Ruleset Update Summary - 2026/05/12 - v11191 **URL:** \ **Category:** Ruleset Updates\ **Created:** [May 12, 2026, 8:54pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-05-12-v11191/3315 "2026-05-12T20:54:04Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [May 12, 2026, 8:54pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-05-12-v11191/3315/1 "2026-05-12T20:54:04Z")
## Summary: 9 new OPEN, 16 new PRO (9 + 7) * * * ## Added rules: ### Open: - 2069266 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cpanel .importersexportersltd .com) (malware.rules) - 2069267 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cpanel .importersexportersltd .com) (malware.rules) - 2069268 - ET INFO DYNAMIC\_DNS Query to a \*.sanibelislandfloridarealestate .com domain (info.rules) - 2069269 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.sanibelislandfloridarealestate .com domain (info.rules) - 2069270 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (jinga .locker) (malware.rules) - 2069271 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (jinga .locker) in TLS SNI (malware.rules) - 2069272 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (maloneyr .cyou) (malware.rules) - 2069273 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (maloneyr .cyou) in TLS SNI (malware.rules) - 2069274 - ET EXPLOIT Rclone RC Set Options NoAuth Parameter Authentication Bypass Attempt (CVE-2026-41176) (exploit.rules) ### Pro: - 2867484 - ETPRO EXPLOIT Outlook Classic Use After Free Remote Code Execution Attempt M1 (CVE-2026-40361) (exploit.rules) - 2867485 - ETPRO EXPLOIT Outlook Classic Use After Free Remote Code Execution Attempt M2 (CVE-2026-40361) (exploit.rules) - 2867486 - ETPRO MALWARE DOILoader CnC Activity (User Fingerprinting) (malware.rules) - 2867487 - ETPRO MALWARE DOILoader CnC Activity (Window Tracking) (malware.rules) - 2867488 - ETPRO MALWARE DOILoader CnC Activity (PONG) (malware.rules) - 2867489 - ETPRO MALWARE DOILoader CnC Activity (PING) (malware.rules) - 2867490 - ETPRO EXPLOIT Rclone RC fsinfo Command Injection Attempt (CVE-2026-41179) (exploit.rules) * * * ## Modified inactive rules: - 2069023 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (hegmaen .com) (exploit\_kit.rules) - 2069027 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (images .california-wealth .com) (malware.rules)