# Ruleset Update Summary - 2026/07/16 - v11235 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-16-v11235/3387 **Category:** Ruleset Updates **Created:** [July 16, 2026, 8:54pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-16-v11235/3387 "2026-07-16T20:54:42Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [July 16, 2026, 8:54pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-16-v11235/3387/1 "2026-07-16T20:54:42Z")
## Summary: 16 new OPEN, 52 new PRO (16 + 36) * * * ## Added rules: ### Open: - 2071198 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (screenconnect .com) (info.rules) - 2071199 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (connectwise .com) (info.rules) - 2071200 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (screenconnect .com) (info.rules) - 2071201 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (connectwise .com) (info.rules) - 2071202 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (check .screenconnect .com) (info.rules) - 2071203 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (check .screenconnect .com) (info.rules) - 2071204 - ET INFO Remote Monitoring and Management (RMM) Tools in DNS Lookup (getscreen .me) (info.rules) - 2071205 - ET INFO Observed Remote Monitoring and Management (RMM) Tool in TLS SNI (getscreen .me) (info.rules) - 2071206 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (bitista .icu) (exploit\_kit.rules) - 2071207 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (bitista .icu) (exploit\_kit.rules) - 2071208 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img-eu .veranofund .com) (malware.rules) - 2071209 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img-eu .veranofund .com) (malware.rules) - 2071210 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (emberlattice .top) (exploit\_kit.rules) - 2071211 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (kblaa .com) (exploit\_kit.rules) - 2071212 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (emberlattice .top) (exploit\_kit.rules) - 2071213 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (kblaa .com) (exploit\_kit.rules) ### Pro: - 2867981 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867982 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867983 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867984 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867985 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867986 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867987 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867988 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867989 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867990 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2867991 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2867992 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2867993 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2867994 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2867995 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2867996 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2867997 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2867998 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2867999 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868000 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868001 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868002 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868003 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules) - 2868004 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868005 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules) - 2868006 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules) - 2868007 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868008 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868009 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868010 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868011 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868013 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868014 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868015 - ETPRO MALWARE UNK\_SteadySplit CnC Beacon Activity (Outbound) (malware.rules) - 2868016 - ETPRO MALWARE UNK\_SteadySplit CnC Beacon Activity (Inbound) (malware.rules)