# Ruleset Update Summary - 2026/07/31 - v11247

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-31-v11247/3406>\
**Category:** Ruleset Updates\
**Created:** [July 31, 2026, 8:05pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-31-v11247/3406 "2026-07-31T20:05:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 31, 2026, 8:05pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-07-31-v11247/3406/1 "2026-07-31T20:05:11Z")

</div>

## Summary:

8 new OPEN, 24 new PRO (8 + 16)

* * *

## Added rules:

### Open:

- 2020976 - ET HUNTING HTTP 300-Series Redirect to file URI attempt (hunting.rules)
- 2071351 - ET WEB\_SPECIFIC\_APPS Flowise Authenticated Remote Code Execution (CVE-2026-46442) (web\_specific\_apps.rules)
- 2071352 - ET WEB\_SPECIFIC\_APPS Adobe ColdFusion Path Traversal (CVE-2026-48313) (web\_specific\_apps.rules)
- 2071353 - ET WEB\_SPECIFIC\_APPS ServiceNow AI Platform Unauthenticated JavaScript Sandbox Escape Remote Code Execution (CVE-2026-6875) (web\_specific\_apps.rules)
- 2071354 - ET WEB\_SPECIFIC\_APPS Alibaba Sentinel Default Credentials (CNVD-2021-35876) (web\_specific\_apps.rules)
- 2071355 - ET WEB\_SPECIFIC\_APPS IBM Langflow Auto-Login Bypass (CVE-2026-9198) (web\_specific\_apps.rules)
- 2071356 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (piggybc .cyou) (malware.rules)
- 2071357 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (piggybc .cyou) in TLS SNI (malware.rules)

### Pro:

- 2868097 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868098 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868099 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868100 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868101 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868102 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868103 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868104 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868105 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868106 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868107 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868108 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868109 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868110 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868111 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868112 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

* * *

## Removed rules:

- 2020916 - ET EXPLOIT Possible Redirect to SMB exploit attempt - 302 (exploit.rules)
- 2020917 - ET EXPLOIT Possible Redirect to SMB exploit attempt - 301 (exploit.rules)
- 2020976 - ET EXPLOIT Possible Redirect to SMB exploit attempt - 307 (exploit.rules)
- 2020977 - ET EXPLOIT Possible Redirect to SMB exploit attempt - 303 (exploit.rules)