# Ruleset Update Summary - 2026/09/11 - v11288

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-11-v11288/3453>\
**Category:** Ruleset Updates\
**Created:** [September 11, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-11-v11288/3453 "2026-09-11T20:40:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [September 11, 2026, 8:40pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-11-v11288/3453/1 "2026-09-11T20:40:09Z")

</div>

## Summary:

22 new OPEN, 44 new PRO (22 + 22)

* * *

## Added rules:

### Open:

- 2071996 - ET MALWARE GemStone Gemini Chrome Extension CnC - Register (malware.rules)
- 2071997 - ET MALWARE GemStone Gemini Chrome Extension CnC - Heartbeat (malware.rules)
- 2071998 - ET MALWARE GemStone Gemini Chrome Extension CnC - Ingest (malware.rules)
- 2071999 - ET MALWARE GemStone Gemini Chrome Extension CnC - Screenshots (malware.rules)
- 2072000 - ET MALWARE GemStone Gemini Chrome Extension CnC - Poll Commands (malware.rules)
- 2072001 - ET MALWARE GemStone Gemini Chrome Extension CnC - Command Results (malware.rules)
- 2072002 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (roeerts .cfd) (exploit\_kit.rules)
- 2072003 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (aatthews .cfd) (exploit\_kit.rules)
- 2072004 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (hodkiewhcz .sbs) (exploit\_kit.rules)
- 2072005 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (kusikowski .sbs) (exploit\_kit.rules)
- 2072006 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (roeerts .cfd) (exploit\_kit.rules)
- 2072007 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (aatthews .cfd) (exploit\_kit.rules)
- 2072008 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (hodkiewhcz .sbs) (exploit\_kit.rules)
- 2072009 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (kusikowski .sbs) (exploit\_kit.rules)
- 2072010 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (gws-api .snus-grossiste .com) (malware.rules)
- 2072011 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (redhat .psychedelicshome .live) (malware.rules)
- 2072012 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (gws-api .snus-grossiste .com) (malware.rules)
- 2072013 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (redhat .psychedelicshome .live) (malware.rules)
- 2072014 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tritonbody .fun) (malware.rules)
- 2072015 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tritonbody .fun) in TLS SNI (malware.rules)
- 2072016 - ET EXPLOIT WAVLINK Sync Server Command Injection/Arbitrary File Write Attempt (CVE-2026-89010, CVE-2026-89009) (exploit.rules)
- 2072017 - ET HUNTING GET to ip .ipify .org via WinHTTP (hunting.rules)

### Pro:

- 2868541 - ETPRO MALWARE Observed DNS Query to Malicious Domain (malware.rules)
- 2868542 - ETPRO MALWARE Observed DNS Query to Malicious Domain (malware.rules)
- 2868543 - ETPRO MALWARE Observed Malicious Domain in TLS SNI (malware.rules)
- 2868544 - ETPRO MALWARE Observed Malicious Domain in TLS SNI (malware.rules)
- 2868545 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868546 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868547 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868548 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868549 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868550 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868551 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868552 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868553 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868554 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868555 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868556 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868557 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868558 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868559 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868560 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868561 - ETPRO ATTACK\_RESPONSE Ransomware Attack Chain .bat Inbound (attack\_response.rules)
- 2868562 - ETPRO MALWARE MatrixHyper CnC Response (File Not Found) (malware.rules)

* * *

## Modified inactive rules:

- 2867843 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2867857 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)