# Ruleset Update Summary - 2026/06/24 - v11220 **URL:** \ **Category:** Ruleset Updates\ **Created:** [June 24, 2026, 8:50pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-24-v11220/3363 "2026-06-24T20:50:04Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [June 24, 2026, 8:50pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-06-24-v11220/3363/1 "2026-06-24T20:50:04Z")
## Summary: 6 new OPEN, 31 new PRO (6 + 25) * * * ## Added rules: ### Open: - 2070055 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (uolguin .cfd) (exploit\_kit.rules) - 2070056 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (ledesla .cfd) (exploit\_kit.rules) - 2070057 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (uolguin .cfd) (exploit\_kit.rules) - 2070058 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (ledesla .cfd) (exploit\_kit.rules) - 2070059 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (coralwayfinder .top) (exploit\_kit.rules) - 2070060 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (coralwayfinder .top) (exploit\_kit.rules) ### Pro: - 2867768 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867769 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867770 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867771 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867772 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867773 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867774 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867775 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867776 - ETPRO PHISHING Request to Fake Calendly Meeting Landing Page (phishing.rules) - 2867777 - ETPRO PHISHING TA2730 Site Config Request (phishing.rules) - 2867778 - ETPRO PHISHING Fake Calendly Meeting Landing Page (phishing.rules) - 2867779 - ETPRO PHISHING Observed DNS Query to Device Code Phishing Domain (phishing.rules) - 2867780 - ETPRO PHISHING Observed DNS Query to Device Code Phishing Domain (phishing.rules) - 2867781 - ETPRO PHISHING Observed DNS Query to Device Code Phishing Domain (phishing.rules) - 2867782 - ETPRO PHISHING Observed DNS Query to Device Code Phishing Domain (phishing.rules) - 2867783 - ETPRO PHISHING Observed DNS Query to Device Code Phishing Domain (phishing.rules) - 2867784 - ETPRO PHISHING Observed Device Code Phishing Domain Domain in TLS SNI (phishing.rules) - 2867785 - ETPRO PHISHING Observed Device Code Phishing Domain Domain in TLS SNI (phishing.rules) - 2867786 - ETPRO PHISHING Observed Device Code Phishing Domain Domain in TLS SNI (phishing.rules) - 2867787 - ETPRO PHISHING Observed Device Code Phishing Domain Domain in TLS SNI (phishing.rules) - 2867788 - ETPRO PHISHING Observed Device Code Phishing Domain Domain in TLS SNI (phishing.rules) - 2867789 - ETPRO PHISHING Observed DNS Query to Fake Calendly Credential Theft Landing Page Domain (phishing.rules) - 2867790 - ETPRO PHISHING Observed DNS Query to Fake Calendly Credential Theft Landing Page Domain (phishing.rules) - 2867791 - ETPRO PHISHING Observed Fake Calendly Credential Theft Landing Page Domain in TLS SNI (phishing.rules) - 2867792 - ETPRO PHISHING Observed Fake Calendly Credential Theft Landing Page Domain in TLS SNI (phishing.rules)