# Ruleset Update Summary - 2026/08/14 - v11257 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 14, 2026, 7:56pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-14-v11257/3420 "2026-08-14T19:56:18Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 14, 2026, 7:56pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-14-v11257/3420/1 "2026-08-14T19:56:18Z")
## Summary: 19 new OPEN, 32 new PRO (19 + 13) * * * ## Added rules: ### Open: - 2071518 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M11 (exploit\_kit.rules) - 2071519 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M12 (exploit\_kit.rules) - 2071520 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M13 (exploit\_kit.rules) - 2071521 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M14 (exploit\_kit.rules) - 2071522 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M15 (exploit\_kit.rules) - 2071523 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M16 (exploit\_kit.rules) - 2071524 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M17 (exploit\_kit.rules) - 2071525 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M18 (exploit\_kit.rules) - 2071526 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M19 (exploit\_kit.rules) - 2071527 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M20 (exploit\_kit.rules) - 2071528 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nisyqai .shop) (malware.rules) - 2071529 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (nisyqai .shop) in TLS SNI (malware.rules) - 2071530 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (unapjjh .shop) (malware.rules) - 2071531 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (unapjjh .shop) in TLS SNI (malware.rules) - 2071532 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (youngnu .xyz) (malware.rules) - 2071533 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (youngnu .xyz) in TLS SNI (malware.rules) - 2071534 - ET INFO Free Hosting Domain in DNS Lookup (zya .me) (info.rules) - 2071535 - ET INFO Free Hosting Domain in TLS SNI (zya .me) (info.rules) - 2071536 - ET WEB\_SPECIFIC\_APPS Metabase Password Reset SQL Injection (CVE-2026-72898) (web\_specific\_apps.rules) ### Pro: - 2868238 - ETPRO EXPLOIT Adobe Commerce & Magento Session Identity Hijack Attempt (CVE-2026-71362) (exploit.rules) - 2868240 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile\_malware.rules) - 2868241 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868242 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868243 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868244 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868245 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868246 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868247 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868248 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868249 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile\_malware.rules) - 2868250 - ETPRO PHISHING TA2900 Telegram Exfil 2026-08-14 (phishing.rules) - 2868251 - ETPRO PHISHING TA2900 Telegram Exfil Response (phishing.rules) * * * ## Disabled and modified rules: - 2820132 - ETPRO WEB\_CLIENT Possible Adobe Reader (CVE-2016-1051) (web\_client.rules)