# Ruleset Update Summary - 2026/08/19 - v11260 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 19, 2026, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-19-v11260/3424 "2026-08-19T20:41:52Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 19, 2026, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-19-v11260/3424/1 "2026-08-19T20:41:52Z")
## Summary: 54 new OPEN, 84 new PRO (54 + 30) * * * ## Added rules: ### Open: - 2071583 - ET CURRENT\_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCFleet/1.0) (current\_events.rules) - 2071584 - ET CURRENT\_EVENTS VMware Exploit Campaign Inbound - User-Agent (GoodMoodle-VCProbe/1.0) (current\_events.rules) - 2071585 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (randenbrink .lol) (exploit\_kit.rules) - 2071586 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (rutrerford .lol) (exploit\_kit.rules) - 2071587 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (stevsns .lol) (exploit\_kit.rules) - 2071588 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (vanloon .lol) (exploit\_kit.rules) - 2071589 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (randenbrink .lol) (exploit\_kit.rules) - 2071590 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (rutrerford .lol) (exploit\_kit.rules) - 2071591 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (stevsns .lol) (exploit\_kit.rules) - 2071592 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (vanloon .lol) (exploit\_kit.rules) - 2071593 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cdnmedia .trailsyamahamotor .com) (malware.rules) - 2071594 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (missed-upd .happyhatterreviews .com) (malware.rules) - 2071595 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cdnmedia .trailsyamahamotor .com) (malware.rules) - 2071596 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (missed-upd .happyhatterreviews .com) (malware.rules) - 2071597 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chemistrycworner .today) (malware.rules) - 2071598 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chemistrycworner .today) in TLS SNI (malware.rules) - 2071599 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (datadynnamics .today) (malware.rules) - 2071600 - ET WEB\_SPECIFIC\_APPS Microsoft Windows Admin Center Elevation of Privilege (CVE-2026-26119) (web\_specific\_apps.rules) - 2071601 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (datadynnamics .today) in TLS SNI (malware.rules) - 2071602 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (elephancouped .fun) (malware.rules) - 2071603 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (elephancouped .fun) in TLS SNI (malware.rules) - 2071604 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mildpacewp .today) (malware.rules) - 2071605 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mildpacewp .today) in TLS SNI (malware.rules) - 2071606 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (penetratebatt .pw) (malware.rules) - 2071607 - ET WEB\_SPECIFIC\_APPS Progress WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass (CVE-2024-6671) (web\_specific\_apps.rules) - 2071608 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (penetratebatt .pw) in TLS SNI (malware.rules) - 2071609 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (unigtyincommunity .tech) (malware.rules) - 2071610 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (unigtyincommunity .tech) in TLS SNI (malware.rules) - 2071611 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zenrichyourlife .tech) (malware.rules) - 2071612 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zenrichyourlife .tech) in TLS SNI (malware.rules) - 2071613 - ET MALWARE Observed DNS Query to ClickFix Domain (designerlink .su) (malware.rules) - 2071614 - ET MALWARE Observed DNS Query to ClickFix Domain (akb .cat) (malware.rules) - 2071615 - ET MALWARE Observed DNS Query to ClickFix Domain (designlinks .live) (malware.rules) - 2071616 - ET MALWARE Observed DNS Query to ClickFix Domain (zrorolite .com) (malware.rules) - 2071617 - ET MALWARE Observed ClickFix Domain (designerlink .su in TLS SNI) (malware.rules) - 2071618 - ET MALWARE Observed ClickFix Domain (akb .cat in TLS SNI) (malware.rules) - 2071619 - ET MALWARE Observed ClickFix Domain (designlinks .live in TLS SNI) (malware.rules) - 2071620 - ET MALWARE Observed ClickFix Domain (zrorolite .com in TLS SNI) (malware.rules) - 2071621 - ET INFO Observed Telegram Domain in DNS Lookup (t .you) (info.rules) - 2071622 - ET INFO Observed Telegram Domain in TLS SNI (t .you) (info.rules) - 2071623 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .dog) (info.rules) - 2071624 - ET INFO Observed Telegram Domain in TLS SNI (telegram .dog) (info.rules) - 2071625 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .gift) (info.rules) - 2071626 - ET INFO Observed Telegram Domain in TLS SNI (telegram .gift) (info.rules) - 2071627 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .org) (info.rules) - 2071628 - ET INFO Observed Telegram Domain in TLS SNI (telegram .org) (info.rules) - 2071629 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .space) (info.rules) - 2071630 - ET INFO Observed Telegram Domain in TLS SNI (telegram .space) (info.rules) - 2071631 - ET INFO Observed Telegram Domain in DNS Lookup (telegram .supply) (info.rules) - 2071632 - ET INFO Observed Telegram Domain in TLS SNI (telegram .supply) (info.rules) - 2071633 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules) - 2071634 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules) - 2071635 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules) - 2071636 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules) ### Pro: - 2804662 - ETPRO RETIRED Adobe Flash Player file with Matrix3D.copyRawDataFrom() function (retired.rules) - 2811346 - ETPRO RETIRED Internet Explorer Memory Corruption Vulnerability (CVE-2015-1731) (retired.rules) - 2868298 - ETPRO MALWARE Vidar Stealer CnC Checkin Response (malware.rules) - 2868299 - ETPRO MALWARE Vidar Stealer CnC Activity via Telegram (malware.rules) - 2868300 - ETPRO MALWARE Vidar Stealer CnC Activity via Telegram (malware.rules) - 2868301 - ETPRO MALWARE Observed Vidar Stealer User-Agent (malware.rules) - 2868302 - ETPRO ACTIVEX PTC Windchill JSP Webshell Inbound Requests (activex.rules) - 2868303 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868304 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868305 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868306 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868307 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868308 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868309 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868310 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868311 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868312 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868313 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868314 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868315 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868316 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868317 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868318 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868319 - ETPRO EXPLOIT Netgate pfSense Authenticated RCE via Unsafe Deserialization (CVE-2025-69690) (exploit.rules) - 2868320 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2868321 - ETPRO EXPLOIT Netgate pfSense Authenticated RCE via XMLRPC exec\_php (CVE-2025-69691) (exploit.rules) - 2868322 - ETPRO EXPLOIT\_KIT ClickFix Javascript Loader Observed (exploit\_kit.rules) - 2868323 - ETPRO EXPLOIT\_KIT ClickFix Javascript Loader Observed (exploit\_kit.rules) - 2868324 - ETPRO MALWARE ClickFix Campaign Tracker CnC Activity (malware.rules) - 2868325 - ETPRO MALWARE ClickFix Campaign Tracker CnC Response (malware.rules) * * * ## Disabled and modified rules: - 2850244 - ETPRO WEB\_CLIENT V8 Engine Type Confusion Exploit Inbound - POC Based (CVE-2021-21224) (web\_client.rules) * * * ## Removed rules: - 2804662 - ETPRO WEB\_CLIENT Adobe Flash Player file with Matrix3D.copyRawDataFrom() function (web\_client.rules) - 2811346 - ETPRO WEB\_CLIENT Internet Explorer Memory Corruption Vulnerability (CVE-2015-1731) (web\_client.rules)