# Ruleset Update Summary - 2026/07/27 - v11242 **URL:** \ **Category:** Ruleset Updates\ **Created:** [July 27, 2026, 8:13pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-27-v11242/3400 "2026-07-27T20:13:13Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [July 27, 2026, 8:13pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-27-v11242/3400/1 "2026-07-27T20:13:13Z")
## Summary: 36 new OPEN, 46 new PRO (36 + 10) * * * ## Added rules: ### Open: - 2071293 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abangan .cyou) (malware.rules) - 2071294 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abangan .cyou) in TLS SNI (malware.rules) - 2071295 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (boothroundupdow .fun) (malware.rules) - 2071296 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (boothroundupdow .fun) in TLS SNI (malware.rules) - 2071297 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (businway .cyou) (malware.rules) - 2071298 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (businway .cyou) in TLS SNI (malware.rules) - 2071299 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (citymket .cyou) (malware.rules) - 2071300 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (citymket .cyou) in TLS SNI (malware.rules) - 2071301 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (creaflow .cyou) (malware.rules) - 2071302 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (creaflow .cyou) in TLS SNI (malware.rules) - 2071303 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formiklass .fun) (malware.rules) - 2071304 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (formiklass .fun) in TLS SNI (malware.rules) - 2071305 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (futurtep .cyou) (malware.rules) - 2071306 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (futurtep .cyou) in TLS SNI (malware.rules) - 2071307 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (smaridge .cyou) (malware.rules) - 2071308 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (smaridge .cyou) in TLS SNI (malware.rules) - 2071309 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starzone .cyou) (malware.rules) - 2071310 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (starzone .cyou) in TLS SNI (malware.rules) - 2071311 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trendion .cyou) (malware.rules) - 2071312 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trendion .cyou) in TLS SNI (malware.rules) - 2071313 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (visioint .cyou) (malware.rules) - 2071314 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (visioint .cyou) in TLS SNI (malware.rules) - 2071315 - ET WEB\_SPECIFIC\_APPS Sonicwall Diagnostics page target Parameter Command Injection Attempt (CVE-2023-44221) (web\_specific\_apps.rules) - 2071316 - ET WEB\_SPECIFIC\_APPS SAP NetWeaver scheduler URI Directory Traversal Attempt (CVE-2017-12637) (web\_specific\_apps.rules) - 2071317 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (bauabach .lol) (exploit\_kit.rules) - 2071318 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (chaphan .click) (exploit\_kit.rules) - 2071319 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (bauabach .lol) (exploit\_kit.rules) - 2071320 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (chaphan .click) (exploit\_kit.rules) - 2071321 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (astrotg .world) (malware.rules) - 2071322 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (astrotg .world) in TLS SNI (malware.rules) - 2071323 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (milezcv .cyou) (malware.rules) - 2071324 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (milezcv .cyou) in TLS SNI (malware.rules) - 2071325 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sceeptersong .digital) (malware.rules) - 2071326 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sceeptersong .digital) in TLS SNI (malware.rules) - 2071327 - ET WEB\_SPECIFIC\_APPS vBulletin Unauthenticated Remote Code Execution (CVE-2026-61511) (web\_specific\_apps.rules) - 2071328 - ET WEB\_SPECIFIC\_APPS QNAP Malware Remover Python Code Injection (CVE-2025-11837) (web\_specific\_apps.rules) ### Pro: - 2868068 - ETPRO MALWARE TA569 Gholoader CnC URI M1 (malware.rules) - 2868069 - ETPRO MALWARE TA569 Gholoader CnC URI M2 (malware.rules) - 2868070 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868071 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868072 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868073 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868074 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868075 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868076 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868077 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)