# Ruleset Update Summary - 2026/09/10 - v11287

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-10-v11287/3452>\
**Category:** Ruleset Updates\
**Created:** [September 10, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-10-v11287/3452 "2026-09-10T20:40:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [September 10, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-10-v11287/3452/1 "2026-09-10T20:40:23Z")

</div>

## Summary:

13 new OPEN, 46 new PRO (13 + 33)

* * *

## Added rules:

### Open:

- 2012064 - ET RETIRED Foxit PDF Reader Title Stack Overflow (retired.rules)
- 2071984 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (regions .globalcargonetwork .com) (malware.rules)
- 2071985 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (regions .globalcargonetwork .com) (malware.rules)
- 2071986 - ET WEB\_SPECIFIC\_APPS Sangoma Switchvox PhoneIP Parameter SQL Injection Attempt (CVE-2026-9586) (web\_specific\_apps.rules)
- 2071987 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (taretool .pw) (malware.rules)
- 2071988 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (taretool .pw) in TLS SNI (malware.rules)
- 2071989 - ET EXPLOIT\_KIT Darksword iOS EK Landing Page (exploit\_kit.rules)
- 2071990 - ET MALWARE Cobalt Strike CnC Beacon (GET) (malware.rules)
- 2071991 - ET EXPLOIT\_KIT Darksword iOS EK RCE Loader Page (exploit\_kit.rules)
- 2071992 - ET EXPLOIT\_KIT Darksword iOS EK RCE Worker Page (exploit\_kit.rules)
- 2071993 - ET EXPLOIT\_KIT Darksword iOS EK RCE Module Page (exploit\_kit.rules)
- 2071994 - ET MALWARE Cobalt Strike Beacon Beacon Domain in DNS Lookup (employeenotifierdevice-cha9g0g9g4hebmea .z02 .azurefd .net) (malware.rules)
- 2071995 - ET MALWARE Observed Cobalt Strike Beacon Domain (employeenotifierdevice-cha9g0g9g4hebmea .z02 .azurefd .net in TLS SNI) (malware.rules)

### Pro:

- 2868508 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868509 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868510 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868511 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868512 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868513 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868514 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868515 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868516 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868517 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868518 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868519 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868520 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868521 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868522 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868523 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868524 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868525 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868526 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868527 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868528 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868529 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868530 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868531 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868532 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868533 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868534 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868535 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868536 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868537 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868538 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868539 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868540 - ETPRO MALWARE Amatera Stealer CnC Exfil (POST) M5 (malware.rules)

* * *

## Removed rules:

- 2012064 - ET WEB\_CLIENT Foxit PDF Reader Title Stack Overflow (web\_client.rules)