# Ruleset Update Summary - 2026/09/17 - v11292 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 17, 2026, 9:03pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-17-v11292/3457 "2026-09-17T21:03:00Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 17, 2026, 9:03pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-17-v11292/3457/1 "2026-09-17T21:03:00Z")
## Summary: 34 new OPEN, 81 new PRO (34 + 47) * * * ## Added rules: ### Open: - 2072056 - ET PHISHING Generic Phish Request to RMM M1 2026-09-16 (phishing.rules) - 2072057 - ET PHISHING Generic Phish Request to RMM M2 2026-09-16 (phishing.rules) - 2072058 - ET INFO Zecurit RMM Activity - Agent Registration (info.rules) - 2072059 - ET INFO Zecurit RMM Activity - Agent Outbound Command Sent (info.rules) - 2072060 - ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved (info.rules) - 2072061 - ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved for agentDownloadURL (info.rules) - 2072062 - ET INFO Zecurit RMM Activity - Agent Exfil User Fingerprint (info.rules) - 2072063 - ET INFO External IP Lookup - ipleak .net (info.rules) - 2072064 - ET INFO External IP Lookup Domain (ipleak .net) in DNS Lookup (info.rules) - 2072065 - ET INFO Observed External IP Lookup Domain (ipleak .net) in TLS SNI (info.rules) - 2072066 - ET INFO DYNAMIC\_DNS Query to a \*.robertschulze .org domain (info.rules) - 2072067 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.robertschulze .org domain (info.rules) - 2072068 - ET INFO DYNAMIC\_DNS Query to a \*.chanka .com domain (info.rules) - 2072069 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.chanka .com domain (info.rules) - 2072070 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (oceanpebble .shop) (malware.rules) - 2072071 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (oceanpebble .shop) in TLS SNI (malware.rules) - 2072072 - ET MALWARE AMOS ClickFix Campaign - Bash Stager M1 (malware.rules) - 2072073 - ET MALWARE AMOS ClickFix Campaign - Bash Stager M2 (malware.rules) - 2072074 - ET MALWARE AMOS ClickFix Campaign - AMOS Payload Request (malware.rules) - 2072075 - ET MALWARE AMOS ClickFix Campaign - AMOS Loader Script Request (malware.rules) - 2072076 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (engine .commdistinc .com) (malware.rules) - 2072077 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (engine .commdistinc .com) (malware.rules) - 2072078 - ET MALWARE Observed DNS Query to BlueMoon EK CnC (malware.rules) - 2072079 - ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI (malware.rules) - 2072080 - ET MALWARE Observed BlueMoon EK CnC Related Domain in DNS Query (malware.rules) - 2072081 - ET MALWARE Observed BlueMoon EK CnC Related Domain in TLS SNI (malware.rules) - 2072082 - ET MALWARE Observed Cobalt Strike CnC Related Domain in DNS Query (malware.rules) - 2072083 - ET MALWARE Observed CobaltStrike CnC Related Domain in TLS SNI (malware.rules) - 2072084 - ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query (malware.rules) - 2072085 - ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI (malware.rules) - 2072086 - ET MALWARE Observed Exploit Kit Profiler Related Domain in DNS Query (malware.rules) - 2072087 - ET MALWARE Observed Exploit Kit Profiler Related Domain in TLS SNI (malware.rules) - 2072088 - ET MALWARE Observed DarkSword EK Related Domain in DNS Query (malware.rules) - 2072089 - ET MALWARE Observed DarkSword EK Related Domain in TLS SNI (malware.rules) ### Pro: - 2868624 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868625 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868626 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868627 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868628 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868629 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868630 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868631 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868632 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868633 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868634 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868635 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868636 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868637 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868638 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868639 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868640 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868641 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868642 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules) - 2868643 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868644 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules) - 2868645 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules) - 2868646 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868647 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868648 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868649 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868650 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868651 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868652 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868653 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2868654 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2868655 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868656 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868657 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2868658 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2868659 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - INFO Outbound (malware.rules) - 2868660 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2868661 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD+ Inbound (malware.rules) - 2868662 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - RD- Outbound (malware.rules) - 2868663 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2868664 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2868665 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2868666 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2868667 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2868668 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2868669 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2868670 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)