# Ruleset Update Summary - 2026/07/09 - v11230 **URL:** \ **Category:** Ruleset Updates\ **Created:** [July 9, 2026, 8:30pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-09-v11230/3379 "2026-07-09T20:30:46Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [July 9, 2026, 8:30pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-09-v11230/3379/1 "2026-07-09T20:30:46Z")
## Summary: 13 new OPEN, 23 new PRO (13 + 10) * * * ## Added rules: ### Open: - 2071132 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (carreiro .lol) (exploit\_kit.rules) - 2071133 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (henreques .lol) (exploit\_kit.rules) - 2071134 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (carreiro .lol) (exploit\_kit.rules) - 2071135 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (henreques .lol) (exploit\_kit.rules) - 2071136 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (client-side .cellustrong .com) (malware.rules) - 2071137 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (client-side .cellustrong .com) (malware.rules) - 2071138 - ET WEB\_SPECIFIC\_APPS Gitea API Authentication Bypass (CVE-2026-20896) (web\_specific\_apps.rules) - 2071139 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bittercoldzzdwu .shop) (malware.rules) - 2071140 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bittercoldzzdwu .shop) in TLS SNI (malware.rules) - 2071141 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (conferenctdressingshrw .site) (malware.rules) - 2071142 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (conferenctdressingshrw .site) in TLS SNI (malware.rules) - 2071143 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (teachherwjw .shop) (malware.rules) - 2071144 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (teachherwjw .shop) in TLS SNI (malware.rules) ### Pro: - 2867935 - ETPRO WEB\_SPECIFIC\_APPS OPNsense Secrets Disclosure via XPATH Injection (CVE-2026-53582) (web\_specific\_apps.rules) - 2867936 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867937 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867938 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867939 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867940 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867941 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867942 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867943 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867944 - ETPRO WEB\_SPECIFIC\_APPS Microsoft SharePoint Taxonomy SQLi (CVE-2026-26114) (web\_specific\_apps.rules) * * * ## Modified inactive rules: - 2867923 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)