# Ruleset Update Summary - 2026/07/01 - v11225 **URL:** \ **Category:** Ruleset Updates\ **Created:** [July 1, 2026, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-01-v11225/3369 "2026-07-01T20:52:57Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [July 1, 2026, 8:52pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-01-v11225/3369/1 "2026-07-01T20:52:57Z")
## Summary: 20 new OPEN, 23 new PRO (20 + 3) There will be no release Friday July 3rd. * * * ## Added rules: ### Open: - 2070125 - ET WEB\_SPECIFIC\_APPS Progress Kemp Loadmaster Remote Code Execution (CVE-2026-8037) (web\_specific\_apps.rules) - 2070126 - ET WEB\_SPECIFIC\_APPS [aretiq.ai] Exchange EWS InstallApp with ManifestUrl Server-Side Request Forgery Attempt (CVE-2026-45502) (web\_specific\_apps.rules) - 2070127 - ET WEB\_SPECIFIC\_APPS Langflow AI Authenticated Arbitrary File Write via Path Traversal (CVE-2026-33309) (web\_specific\_apps.rules) - 2070128 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soupedburhsh .biz) (malware.rules) - 2070129 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (soupedburhsh .biz) in TLS SNI (malware.rules) - 2070130 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (triangledh .store) (malware.rules) - 2070131 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (triangledh .store) in TLS SNI (malware.rules) - 2070132 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (abernaahy .sbs) (exploit\_kit.rules) - 2070133 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (reindardt .lol) (exploit\_kit.rules) - 2070134 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (schuttc .lol) (exploit\_kit.rules) - 2070135 - ET WEB\_SPECIFIC\_APPS UniFi Network Application Unauthenticated Path Traversal (CVE-2026-22557) (web\_specific\_apps.rules) - 2070136 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (abernaahy .sbs) (exploit\_kit.rules) - 2070137 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (reindardt .lol) (exploit\_kit.rules) - 2070138 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (schuttc .lol) (exploit\_kit.rules) - 2070139 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (files .crapofirouzi .com) (malware.rules) - 2070140 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (files .crapofirouzi .com) (malware.rules) - 2070141 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (bronzehorizon .top) (exploit\_kit.rules) - 2070142 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (linenharvest .top) (exploit\_kit.rules) - 2070143 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (bronzehorizon .top) (exploit\_kit.rules) - 2070144 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (linenharvest .top) (exploit\_kit.rules) ### Pro: - 2867875 - ETPRO WEB\_SPECIFIC\_APPS Langflow AI Unauthenticated Remote Code Execution (CVE-2026-33017) (web\_specific\_apps.rules) - 2867876 - ETPRO HUNTING Response Header Override via HTTP Request Parameter (hunting.rules) - 2867877 - ETPRO WEB\_SPECIFIC\_APPS Microsoft Sharepoint Remote Code Execution via ProxyUpdateExecutor (web\_specific\_apps.rules) * * * ## Disabled and modified rules: - 2070106 - ET MALWARE Observed VenomRAT SSL Cert (malware.rules) - 2070117 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (coralwayfinder .top) (exploit\_kit.rules) - 2070118 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (coralwayfinder .top) (exploit\_kit.rules) - 2867843 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867847 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867852 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867857 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867859 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)