# Ruleset Update Summary - 2026/08/03 - v11248

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-03-v11248/3407>\
**Category:** Ruleset Updates\
**Created:** [August 3, 2026, 8:16pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-03-v11248/3407 "2026-08-03T20:16:47Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [August 3, 2026, 8:16pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-03-v11248/3407/1 "2026-08-03T20:16:47Z")

</div>

## Summary:

10 new OPEN, 28 new PRO (10 + 18)

* * *

## Added rules:

### Open:

- 2071358 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (matchny .cyou) (malware.rules)
- 2071359 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (matchny .cyou) in TLS SNI (malware.rules)
- 2071360 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (perfoxd .xyz) (malware.rules)
- 2071361 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (perfoxd .xyz) in TLS SNI (malware.rules)
- 2071362 - ET HUNTING FTP (passive) LIST Response NUL Byte After Timestamp (hunting.rules)
- 2071363 - ET WEB\_SPECIFIC\_APPS W3 Total Cache admin-post.php browsercache\_\_security\_\_xfo\_\_allow Parameter Remote Code Execution Attempt (CVE-2026-57623) (web\_specific\_apps.rules)
- 2071364 - ET HUNTING FTP (active) LIST Response NUL Byte After Timestamp (hunting.rules)
- 2071365 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bizsmmit .cyou) (malware.rules)
- 2071366 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bizsmmit .cyou) in TLS SNI (malware.rules)
- 2071367 - ET WEB\_SPECIFIC\_APPS Flowise chatflows id Parameter Directory Traversal Attempt (CVE-2025-71334) (web\_specific\_apps.rules)

### Pro:

- 2868113 - ETPRO HUNTING Laravel Excessively Large Cookie in HTTP Request (hunting.rules)
- 2868114 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868115 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868116 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868117 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868118 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868119 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules)
- 2868120 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
- 2868121 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules)
- 2868122 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules)
- 2868123 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868124 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
- 2868125 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868126 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
- 2868127 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868128 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868129 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
- 2868130 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)