# Ruleset Update Summary - 2026/09/07 - v11284 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 7, 2026, 6:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11284/3448 "2026-09-07T18:39:48Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 7, 2026, 6:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-07-v11284/3448/1 "2026-09-07T18:39:48Z")
## Summary: 16 new OPEN, 16 new PRO (16 + 0) * * * ## Added rules: ### Open: - 2071932 - ET EXPLOIT\_KIT TA2727 Domain in DNS Lookup (muhefahuklodail .com) (exploit\_kit.rules) - 2071933 - ET EXPLOIT\_KIT TA2727 Domain in DNS Lookup (api .ketoriloxisd .com) (exploit\_kit.rules) - 2071934 - ET EXPLOIT\_KIT TA2727 Domain in TLS SNI (muhefahuklodail .com) (exploit\_kit.rules) - 2071935 - ET EXPLOIT\_KIT TA2727 Domain in TLS SNI (api .ketoriloxisd .com) (exploit\_kit.rules) - 2071936 - ET EXPLOIT\_KIT TA2726 CnC Request to Fake Wordpress Plugin M1 (exploit\_kit.rules) - 2071937 - ET EXPLOIT\_KIT TA2726 CnC Request to Fake Wordpress Plugin M2 (exploit\_kit.rules) - 2071938 - ET EXPLOIT\_KIT TA2726 CnC Fake Wordpress Plugin Payload M1 (exploit\_kit.rules) - 2071939 - ET EXPLOIT\_KIT TA2726 CnC Fake Wordpress Plugin Payload M2 (exploit\_kit.rules) - 2071940 - ET EXPLOIT\_KIT TA2726 CnC Fake Wordpress Plugin Payload M3 (exploit\_kit.rules) - 2071941 - ET EXPLOIT\_KIT TA2726 CnC Response from admin-ajax.php (exploit\_kit.rules) - 2071942 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (adoptionalbumgesw .shop) (malware.rules) - 2071943 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (adoptionalbumgesw .shop) in TLS SNI (malware.rules) - 2071944 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quitdigitalplatforwi .shop) (malware.rules) - 2071945 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (quitdigitalplatforwi .shop) in TLS SNI (malware.rules) - 2071946 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sermonundressolcow .shop) (malware.rules) - 2071947 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sermonundressolcow .shop) in TLS SNI (malware.rules) * * * ## Disabled and modified rules: - 2868479 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile\_malware.rules) - 2868480 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.ald DNS Query (mobile\_malware.rules)