# Ruleset Update Summary - 2026/09/09 - v11286 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 9, 2026, 8:30pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-09-v11286/3450 "2026-09-09T20:30:42Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 9, 2026, 8:30pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-09-v11286/3450/1 "2026-09-09T20:30:42Z")
## Summary: 6 new OPEN, 15 new PRO (6 + 9) * * * ## Added rules: ### Open: - 2071978 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (claimpassivedebatw .pw) (malware.rules) - 2071979 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (claimpassivedebatw .pw) in TLS SNI (malware.rules) - 2071980 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (coldcoercekowja .fun) (malware.rules) - 2071981 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (coldcoercekowja .fun) in TLS SNI (malware.rules) - 2071982 - ET WEB\_SPECIFIC\_APPS D-Link file\_sharing.cgi fileurl Parameter Command Injection Attempt (CVE-2026-85224) (web\_specific\_apps.rules) - 2071983 - ET WEB\_SPECIFIC\_APPS D-Link dropbox.cgi Multiple Parameters Command Injection Attempt (CVE-2026-85223) (web\_specific\_apps.rules) ### Pro: - 2868499 - ETPRO EXPLOIT\_KIT Observed DNS Query to ClickFix Domain (exploit\_kit.rules) - 2868500 - ETPRO EXPLOIT\_KIT Observed ClickFix Domain in TLS SNI (exploit\_kit.rules) - 2868501 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M1 (malware.rules) - 2868502 - ETPRO MALWARE PowerShell Loader Payload Request For Xord Data (malware.rules) - 2868503 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M2 (malware.rules) - 2868504 - ETPRO MALWARE PowerShell Loader Secondary Payload Request M3 (malware.rules) - 2868505 - ETPRO MALWARE PowerShell Loader Request For Encrypted Payload (malware.rules) - 2868506 - ETPRO HUNTING JavaScript Object Confusion via addrof/fakeobj Primitives (hunting.rules) - 2868507 - ETPRO HUNTING WebAssembly Exception/Table Type Confusion (Opcodes) (hunting.rules) * * * ## Modified inactive rules: - 2867859 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)