# Ruleset Update Summary - 2026/06/23 - v11219 **URL:** \ **Category:** Ruleset Updates\ **Created:** [June 23, 2026, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-23-v11219/3362 "2026-06-23T20:52:43Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [June 23, 2026, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-23-v11219/3362/1 "2026-06-23T20:52:43Z")
## Summary: 21 new OPEN, 28 new PRO (21 + 7) * * * ## Added rules: ### Open: - 2070034 - ET INFO Ethereum Contract Request, get() (info.rules) - 2070035 - ET INFO Ethereum Contract Request, getURL() (info.rules) - 2070036 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (WieseSpark .cyou) (malware.rules) - 2070037 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (WieseSpark .cyou) in TLS SNI (malware.rules) - 2070038 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (settlehillcanne .pw) (malware.rules) - 2070039 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (settlehillcanne .pw) in TLS SNI (malware.rules) - 2070040 - ET INFO Observed DNS Query to Automox RMM Console Domain (console .automox .com) (info.rules) - 2070041 - ET INFO Observed Automox RMM Console Domain Domain (console .automox .com in TLS SNI) (info.rules) - 2070042 - ET HUNTING Automox RMM Installer Downloaded From 3rd Party (hunting.rules) - 2070043 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (consumer .fsia .net) (malware.rules) - 2070044 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (consumer .fsia .net) (malware.rules) - 2070045 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (cobaltmeadow .top) (exploit\_kit.rules) - 2070046 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (ibharcan .com) (exploit\_kit.rules) - 2070047 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (ivorycourtyard .top) (exploit\_kit.rules) - 2070048 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (cobaltmeadow .top) (exploit\_kit.rules) - 2070049 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (ibharcan .com) (exploit\_kit.rules) - 2070050 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (ivorycourtyard .top) (exploit\_kit.rules) - 2070051 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (bartach .xyz) (exploit\_kit.rules) - 2070052 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (gileert .xyz) (exploit\_kit.rules) - 2070053 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (bartach .xyz) (exploit\_kit.rules) - 2070054 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (gileert .xyz) (exploit\_kit.rules) ### Pro: - 2867761 - ETPRO MALWARE SecTopRAT Payload Request via EtherHiding (malware.rules) - 2867762 - ETPRO MALWARE Observed DNS Query to TA569 SocGholish Domain (malware.rules) - 2867763 - ETPRO MALWARE Observed TA569 SocGholish Domain in TLS SNI (malware.rules) - 2867764 - ETPRO MALWARE Microsoft Teams Fake Updates Landing Page (malware.rules) - 2867765 - ETPRO MALWARE Generic Fake Updates Landing Page (malware.rules) - 2867766 - ETPRO EXPLOIT Ivanti Avalanche MuProperty Type 100 ParseToken DoS (CVE-2024-50320) (exploit.rules) - 2867767 - ETPRO EXPLOIT Ivanti Avalanche MuProperty Type 101-102 Space-only Value DoS (CVE-2024-47007) (exploit.rules)