# Ruleset Update Summary - 2026/09/04 - v11275 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 4, 2026, 6:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11275/3439 "2026-09-04T18:53:40Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 4, 2026, 6:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-04-v11275/3439/1 "2026-09-04T18:53:40Z")
## Summary: 7 new OPEN, 7 new PRO (7 + 0) * * * ## Added rules: ### Open: - 2071925 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (st-dl .documentsupportservices .com) (malware.rules) - 2071926 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (st-dl .documentsupportservices .com) (malware.rules) - 2071927 - ET EXPLOIT\_KIT Malicious TA2726 TDS Domain in DNS Lookup (cdn14 .quran .edu .eu .org) (exploit\_kit.rules) - 2071928 - ET EXPLOIT\_KIT Malicious TA2726 TDS Domain in TLS SNI (cdn14 .quran .edu .eu .org) (exploit\_kit.rules) - 2071929 - ET ATTACK\_RESPONSE Observed Portuguese JS Dropper Inbound M2 (attack\_response.rules) - 2071930 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (breakdecisiveexpandw .fun) (malware.rules) - 2071931 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (breakdecisiveexpandw .fun) in TLS SNI (malware.rules)