# Ruleset Update Summary - 2026/07/07 - v11228

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-07-v11228/3377>\
**Category:** Ruleset Updates\
**Created:** [July 7, 2026, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-07-v11228/3377 "2026-07-07T21:49:32Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 7, 2026, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-07-v11228/3377/1 "2026-07-07T21:49:32Z")

</div>

## Summary:

9 new OPEN, 19 new PRO (9 + 10)

* * *

## Added rules:

### Open:

- 2071115 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (lombaidi .lol) (exploit\_kit.rules)
- 2071116 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (robests .lol) (exploit\_kit.rules)
- 2071117 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (lombaidi .lol) (exploit\_kit.rules)
- 2071118 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (robests .lol) (exploit\_kit.rules)
- 2071119 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (in-us .leadmarketingmachine .com) (malware.rules)
- 2071120 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (in-us .leadmarketingmachine .com) (malware.rules)
- 2071121 - ET ATTACK\_RESPONSE IceCube JS Backdoor Payload (attack\_response.rules)
- 2071122 - ET MALWARE IceCube JS Backdoor C2 Logging (malware.rules)
- 2071123 - ET MALWARE IceCube JS Backdoor C2 Collect Info (malware.rules)

### Pro:

- 2867924 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2867925 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2867926 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2867927 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2867928 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2867929 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2867930 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2867931 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2867932 - ETPRO MALWARE UNK\_TransparentTribe CnC Beacon M1 (malware.rules)
- 2867933 - ETPRO MALWARE UNK\_TransparentTribe CnC Beacon M2 (malware.rules)