# Ruleset Update Summary - 2026/09/02 - v11272 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 2, 2026, 8:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-02-v11272/3436 "2026-09-02T20:51:01Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 2, 2026, 8:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-02-v11272/3436/1 "2026-09-02T20:51:01Z")
## Summary: 24 new OPEN, 57 new PRO (24 + 33) * * * ## Added rules: ### Open: - 2071887 - ET WEB\_SPECIFIC\_APPS Spring Framework Functional Web Frameworks Path Traversal (CVE-2024-38819) (web\_specific\_apps.rules) - 2071888 - ET INFO Observed DNS Query to Fake File Sharing Domain (filelu .cloud) (info.rules) - 2071889 - ET INFO Observed DNS Query File Sharing Domain (filelu .live) (info.rules) - 2071890 - ET INFO Observed DNS Query to File Sharing Domain (filelu .online) (info.rules) - 2071891 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .cloud) (info.rules) - 2071892 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .live) (info.rules) - 2071893 - ET INFO Observed File Sharing Domain in TLS SNI (filelu .online) (info.rules) - 2071894 - ET INFO Observed DNS Query to File Sharing Domain (filelu .com) (info.rules) - 2071895 - ET INFO Observed DNS Query to File Sharing Domain (cdnfront .site) (info.rules) - 2071896 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (advd-api .horecaculinarystudio .com) (malware.rules) - 2071897 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (advd-api .horecaculinarystudio .com) (malware.rules) - 2071898 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (beginningboundewk .xyz) (malware.rules) - 2071899 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (beginningboundewk .xyz) in TLS SNI (malware.rules) - 2071900 - ET INFO Observed File Sharing Domain (filelu .com in TLS SNI) (info.rules) - 2071901 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bitchsafettyudjwu .shop) (malware.rules) - 2071902 - ET INFO Observed File Sharing Domain (cdnfront .site in TLS SNI) (info.rules) - 2071903 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bitchsafettyudjwu .shop) in TLS SNI (malware.rules) - 2071904 - ET WEB\_SPECIFIC\_APPS Atlassian MCP Server-side Request Forgery via HTTP Headers (CVE-2026-27826) M1 (web\_specific\_apps.rules) - 2071905 - ET WEB\_SPECIFIC\_APPS Atlassian MCP Server-side Request Forgery via HTTP Headers (CVE-2026-27826) M2 (web\_specific\_apps.rules) - 2071906 - ET MALWARE Etherhiding Domain in DNS Lookup (metrics-onclick .com) (malware.rules) - 2071907 - ET MALWARE Observed Etherhiding Domain (metrics-onclick .com in TLS SNI) (malware.rules) - 2071908 - ET WEB\_SPECIFIC\_APPS Langflow Unauthenticated Remote Code Execution (CVE-2026-0768) (web\_specific\_apps.rules) - 2071909 - ET HUNTING Script/Executable Downloaded from Filelu (hunting.rules) - 2071910 - ET HUNTING Script/Executable Downloaded from Filelu (cdnfront .site) (hunting.rules) ### Pro: - 2868432 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868433 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868434 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868435 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868437 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868438 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868439 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868440 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868441 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868442 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868443 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868444 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868445 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868446 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868447 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868448 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868449 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868450 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868451 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868452 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868453 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868454 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules) - 2868455 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868456 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules) - 2868457 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules) - 2868458 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868459 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868460 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868461 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868462 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868463 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868464 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868465 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)