# Ruleset Update Summary - 2026/08/27 - v11268 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 27, 2026, 9:08pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-27-v11268/3432 "2026-08-27T21:08:14Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 27, 2026, 9:08pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-08-27-v11268/3432/1 "2026-08-27T21:08:14Z")
## Summary: 10 new OPEN, 10 new PRO (10 + 0) * * * ## Added rules: ### Open: - 2071820 - ET EXPLOIT Apache Log4j2 Issue #4255 FilteredObjectInputStream Allowlist Bypass via java.rmi.MarshalledObject (exploit.rules) - 2071821 - ET HUNTING HTTP Redirect to Dropbox Hosted PDF (hunting.rules) - 2071822 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (expce .directoryindustry .com) (malware.rules) - 2071823 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (expce .directoryindustry .com) (malware.rules) - 2071824 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (barrychorus .store) (malware.rules) - 2071825 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (barrychorus .store) in TLS SNI (malware.rules) - 2071826 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leasebu .bet) (malware.rules) - 2071827 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (leasebu .bet) in TLS SNI (malware.rules) - 2071828 - ET WEB\_SPECIFIC\_APPS D-Link system\_mgr.cgi Multiple Parameters Command Injection Attempt (CVE-2026-8273) (web\_specific\_apps.rules) - 2071829 - ET WEB\_SPECIFIC\_APPS D-Link account\_mgr.cgi app Parameter Command Injection Attempt (CVE-2026-4209) (web\_specific\_apps.rules) * * * ## Disabled and modified rules: - 2071635 - ET INFO Observed Telegram Domain in DNS Lookup (tg-support .org) (info.rules) - 2071636 - ET INFO Observed Telegram Domain in TLS SNI (tg-support .org) (info.rules) - 2071732 - ET MALWARE Lumma Stealer Domain in DNS Lookup (deckerh .cyou) (malware.rules) - 2071733 - ET MALWARE Lumma Stealer Domain in DNS Lookup (matchny .cyou) (malware.rules) - 2071743 - ET MALWARE Lumma Stealer Domain in TLS SNI (matchny .cyou) (malware.rules) - 2868249 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.asa POST Activity (mobile\_malware.rules)