# Ruleset Update Summary - 2026/08/21 - v11262 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 21, 2026, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-21-v11262/3426 "2026-08-21T20:49:03Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 21, 2026, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-21-v11262/3426/1 "2026-08-21T20:49:04Z")
## Summary: 41 new OPEN, 50 new PRO (41 + 9) * * * ## Added rules: ### Open: - 2071683 - ET WEB\_SPECIFIC\_APPS Apache Tika XML External Entity Injection (CVE-2025-54988) (web\_specific\_apps.rules) - 2071684 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (pa-api .salondeguitaredemontreal .com) (malware.rules) - 2071685 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (pa-api .salondeguitaredemontreal .com) (malware.rules) - 2071686 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M52 (exploit\_kit.rules) - 2071687 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M53 (exploit\_kit.rules) - 2071688 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M54 (exploit\_kit.rules) - 2071689 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chiefdramatico .click) (malware.rules) - 2071690 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M55 (exploit\_kit.rules) - 2071691 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chiefdramatico .click) in TLS SNI (malware.rules) - 2071692 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (churhemarke .online) (malware.rules) - 2071693 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M56 (exploit\_kit.rules) - 2071694 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (churhemarke .online) in TLS SNI (malware.rules) - 2071695 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M57 (exploit\_kit.rules) - 2071696 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (confidespill .top) (malware.rules) - 2071697 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (confidespill .top) in TLS SNI (malware.rules) - 2071698 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (declarationlastyj .shop) (malware.rules) - 2071699 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (declarationlastyj .shop) in TLS SNI (malware.rules) - 2071700 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (giddyeldirel .help) (malware.rules) - 2071701 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (giddyeldirel .help) in TLS SNI (malware.rules) - 2071702 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (kitestarepatt .click) (malware.rules) - 2071703 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (kitestarepatt .click) in TLS SNI (malware.rules) - 2071704 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (manuejcruwhj .cyou) (malware.rules) - 2071705 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (manuejcruwhj .cyou) in TLS SNI (malware.rules) - 2071706 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (monstrousdemeniw .shop) (malware.rules) - 2071707 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (monstrousdemeniw .shop) in TLS SNI (malware.rules) - 2071708 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M58 (exploit\_kit.rules) - 2071709 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M59 (exploit\_kit.rules) - 2071710 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M60 (exploit\_kit.rules) - 2071711 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M61 (exploit\_kit.rules) - 2071712 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M62 (exploit\_kit.rules) - 2071713 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M63 (exploit\_kit.rules) - 2071714 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M64 (exploit\_kit.rules) - 2071715 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M65 (exploit\_kit.rules) - 2071716 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M66 (exploit\_kit.rules) - 2071717 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M67 (exploit\_kit.rules) - 2071718 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M68 (exploit\_kit.rules) - 2071719 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M69 (exploit\_kit.rules) - 2071720 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M70 (exploit\_kit.rules) - 2071721 - ET EXPLOIT\_KIT Observed ClickFix Javascript Loader URI to \*.top domain M51 (exploit\_kit.rules) - 2071722 - ET MALWARE go-titan Registration Attempt (malware.rules) - 2071723 - ET WEB\_SPECIFIC\_APPS OpenCTI Hardcoded admin UUID Authentication Bypass (CVE-2026-27960) (web\_specific\_apps.rules) ### Pro: - 2868328 - ETPRO WEB\_SPECIFIC\_APPS Thymeleaf Authentication Bypass (CVE-2026-40478) (web\_specific\_apps.rules) - 2868329 - ETPRO WEB\_SPECIFIC\_APPS GitHub Enterprise Server Remote Code Execution (CVE-2026-3854) (web\_specific\_apps.rules) - 2868331 - ETPRO MALWARE julietaderomeu Config Request M1 (malware.rules) - 2868332 - ETPRO ATTACK\_RESPONSE julietaderomeu Config Inbound M1 (attack\_response.rules) - 2868333 - ETPRO MALWARE julietaderomeu Payload Request (malware.rules) - 2868334 - ETPRO ATTACK\_RESPONSE julietaderomeu Payload Inbound (attack\_response.rules) - 2868335 - ETPRO MALWARE julietaderomeu Config Request M2 (malware.rules) - 2868336 - ETPRO ATTACK\_RESPONSE julietaderomeu Config Inbound M2 (attack\_response.rules) - 2868337 - ETPRO MALWARE julietaderomeu Victim Registration (malware.rules) * * * ## Modified inactive rules: - 2865322 - ETPRO PHISHING Observed DNS Query to TA393 Domain (phishing.rules) - 2865323 - ETPRO PHISHING Observed DNS Query to TA393 Domain (phishing.rules) - 2865324 - ETPRO PHISHING Observed TA393 Domain in TLS SNI (phishing.rules) - 2865325 - ETPRO PHISHING Observed TA393 Domain in TLS SNI (phishing.rules)