# Ruleset Update Summary - 2026/09/03 - v11273

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-03-v11273/3437>\
**Category:** Ruleset Updates\
**Created:** [September 3, 2026, 8:44pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-03-v11273/3437 "2026-09-03T20:44:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [September 3, 2026, 8:44pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-03-v11273/3437/1 "2026-09-03T20:44:49Z")

</div>

## Summary:

8 new OPEN, 32 new PRO (8 + 24)

* * *

## Added rules:

### Open:

- 2071911 - ET MALWARE TonRAT CnC Request to TonAPI Dead Drop Resolver (malware.rules)
- 2071912 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (panel-api .myezwebhost .com) (malware.rules)
- 2071913 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (panel-api .myezwebhost .com) (malware.rules)
- 2071914 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (guiglen .sbs) (exploit\_kit.rules)
- 2071915 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (guiglen .sbs) (exploit\_kit.rules)
- 2071916 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (employeedscratshj .shop) (malware.rules)
- 2071917 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (employeedscratshj .shop) in TLS SNI (malware.rules)
- 2071918 - ET ATTACK\_RESPONSE Observed Portuguese JS Dropper Inbound (attack\_response.rules)

### Pro:

- 2868466 - ETPRO MALWARE Observed DNS Query to TA495 Domain (malware.rules)
- 2868467 - ETPRO MALWARE Observed DNS Query to TA495 Domain (malware.rules)
- 2868468 - ETPRO MALWARE Observed TA395 Domain in TLS SNI (malware.rules)
- 2868469 - ETPRO MALWARE Observed TA395 Domain in TLS SNI (malware.rules)
- 2868470 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868471 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868472 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868473 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868474 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868475 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868476 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868477 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868478 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2868479 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile\_malware.rules)
- 2868480 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile\_malware.rules)
- 2868481 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.cf DNS Query (mobile\_malware.rules)
- 2868482 - ETPRO MALWARE TA395 Victim GET CnC Server Status (malware.rules)
- 2868483 - ETPRO MALWARE TA395 Victim GET Commands from CnC Server (malware.rules)
- 2868484 - ETPRO MALWARE TA395 CnC Commands Inbound (malware.rules)
- 2868485 - ETPRO MALWARE TA395 CnC File Exfiltration (POST) (malware.rules)
- 2868486 - ETPRO MALWARE TA395 CnC Exfil Response Inbound (malware.rules)
- 2868487 - ETPRO MALWARE TA395 Victim CnC Registration (malware.rules)
- 2868488 - ETPRO MALWARE TA395 Victim Registration Response From CnC Server (malware.rules)
- 2868489 - ETPRO MALWARE TA395 Victim CnC HeartBeat (malware.rules)