# Ruleset Update Summary - 2026/07/23 - v11240

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-23-v11240/3395>\
**Category:** Ruleset Updates\
**Created:** [July 23, 2026, 8:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-23-v11240/3395 "2026-07-23T20:06:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 23, 2026, 8:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-23-v11240/3395/1 "2026-07-23T20:06:28Z")

</div>

## Summary:

9 new OPEN, 37 new PRO (9 + 28)

* * *

## Added rules:

### Open:

- 2071268 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appallf .pics) (malware.rules)
- 2071269 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (appallf .pics) in TLS SNI (malware.rules)
- 2071270 - ET WEB\_SPECIFIC\_APPS XWiki Groovy Script Command Injection Attempt M2 (CVE-2024-31982) (web\_specific\_apps.rules)
- 2071271 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (barringer .click) (exploit\_kit.rules)
- 2071272 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (riccardson .click) (exploit\_kit.rules)
- 2071273 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (barringer .click) (exploit\_kit.rules)
- 2071274 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (riccardson .click) (exploit\_kit.rules)
- 2071275 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (api-store .urgaacoffeeroastery .com) (malware.rules)
- 2071276 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (api-store .urgaacoffeeroastery .com) (malware.rules)

### Pro:

- 2868023 - ETPRO PHISHING EvilTokens Landing Page 2026-07-22 (phishing.rules)
- 2868024 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868025 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868026 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868027 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868028 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868029 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868030 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868031 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868032 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868033 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868034 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868035 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868036 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868037 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868038 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868039 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868040 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868041 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868042 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868043 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868044 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868045 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868046 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868047 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868048 - ETPRO PHISHING EvilTokens Gate Check (phishing.rules)
- 2868049 - ETPRO PHISHING EvilTokens Gate Check Response (phishing.rules)
- 2868050 - ETPRO PHISHING EvilTokens Visitor Fingerprint (phishing.rules)

* * *

## Modified inactive rules:

- 2867918 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)