# Ruleset Update Summary - 2026/09/15 - v11290 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-15-v11290/3455 **Category:** Ruleset Updates **Created:** [September 15, 2026, 8:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-15-v11290/3455 "2026-09-15T20:48:22Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [September 15, 2026, 8:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-15-v11290/3455/1 "2026-09-15T20:48:22Z")
## Summary: 12 new OPEN, 15 new PRO (12 + 3) * * * ## Added rules: ### Open: - 2072038 - ET INFO Observed KingSoft Office Domain in DNS Lookup (ksord .com) (info.rules) - 2072039 - ET INFO Observed KingSoft Office Domain in TLS SNI (ksord .com) (info.rules) - 2072040 - ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (\* .zecurit .com) (info.rules) - 2072041 - ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (\* .zecurit .com) (info.rules) - 2072042 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (front-api .ecodevelopmentltd .com) (malware.rules) - 2072043 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (front-api .ecodevelopmentltd .com) (malware.rules) - 2072044 - ET MALWARE Observed DNS Query to ACR Stealer Domain (requests .nicotine .surf) (malware.rules) - 2072045 - ET MALWARE Observed DNS Query to ACR Stealer Domain (enable-debug .empower .surf) (malware.rules) - 2072046 - ET MALWARE Observed DNS Query to ACR Stealer Domain (mail .novaform .cc) (malware.rules) - 2072047 - ET MALWARE Observed ACR Stealer Domain (requests .nicotine .surf in TLS SNI) (malware.rules) - 2072048 - ET MALWARE Observed ACR Stealer Domain (enable-debug .empower .surf in TLS SNI) (malware.rules) - 2072049 - ET MALWARE Observed ACR Stealer Domain (mail .novaform .cc in TLS SNI) (malware.rules) ### Pro: - 2868616 - ETPRO ATTACK\_RESPONSE ACRStealer Powershell Payload Inbound (attack\_response.rules) - 2868617 - ETPRO MALWARE ACRStealer Retrieve Config (malware.rules) - 2868618 - ETPRO MALWARE ACRStealer CnC Activity (POST) (malware.rules)