# Ruleset Update Summary - 2026/09/21 - v11294

**URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-21-v11294/3459
**Category:** Ruleset Updates
**Created:** [September 21, 2026, 7:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-21-v11294/3459 "2026-09-21T19:48:03Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)
#### Post date: [September 21, 2026, 7:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-21-v11294/3459/1 "2026-09-21T19:48:03Z")

</div>

## Summary:

26 new OPEN, 31 new PRO (26 + 5)

* * *

## Added rules:

### Open:

- 2072099 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (mprevive .com) (malware.rules)
- 2072100 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (beta-into .space) (malware.rules)
- 2072101 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (vooi-app .xyz) (malware.rules)
- 2072102 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (opinionvip .club) (malware.rules)
- 2072103 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (app-open .click) (malware.rules)
- 2072104 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (mprevive .com) (malware.rules)
- 2072105 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (beta-into .space) (malware.rules)
- 2072106 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (vooi-app .xyz) (malware.rules)
- 2072107 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (opinionvip .club) (malware.rules)
- 2072108 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (app-open .click) (malware.rules)
- 2072109 - ET MALWARE GateSentinel C2 RemoteTool Registration (malware.rules)
- 2072110 - ET MALWARE GateSentinel C2 RemoteTool Heartbeat (malware.rules)
- 2072111 - ET MALWARE GateSentinel C2 RemoteTool User-Agent (Beacon/) (malware.rules)
- 2072112 - ET MALWARE GateSentinel C2 RemoteTool Task (sleep) (malware.rules)
- 2072113 - ET MALWARE GateSentinel C2 RemoteTool Task (process enum) (malware.rules)
- 2072114 - ET MALWARE GateSentinel C2 RemoteTool Task (shellcode) (malware.rules)
- 2072115 - ET MALWARE GateSentinel C2 RemoteTool Task (command) (malware.rules)
- 2072116 - ET MALWARE PATCHCORD C2 Task (browser hijack) (malware.rules)
- 2072117 - ET INFO DYNAMIC\_DNS Query to a \*.cthulhu .li domain (info.rules)
- 2072118 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.cthulhu .li domain (info.rules)
- 2072119 - ET INFO DYNAMIC\_DNS Query to a \*.brianneburnell .com domain (info.rules)
- 2072120 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.brianneburnell .com domain (info.rules)
- 2072121 - ET WEB\_SPECIFIC\_APPS Netcore network\_tools x Parameter Command Injection Attempt (CVE-2026-94097) (web\_specific\_apps.rules)
- 2072122 - ET WEB\_SPECIFIC\_APPS ipTIME d.cgi aaksjdkfj Parameter Command Injection Attempt (CVE-2026-1741) (web\_specific\_apps.rules)
- 2072123 - ET WEB\_SPECIFIC\_APPS Comfast mbox-config timestr Parameter Buffer Overflow Attempt (CVE-2026-78050) (web\_specific\_apps.rules)
- 2072124 - ET WEB\_SPECIFIC\_APPS Comfast mbox-config timestr Parameter Command Injection Attempt (CVE-2026-77683) (web\_specific\_apps.rules)

### Pro:

- 2868687 - ETPRO MALWARE TA4903 DetectProvider Initialize (malware.rules)
- 2868688 - ETPRO MALWARE TA4903 DetectProvider Send Account Email (malware.rules)
- 2868689 - ETPRO MALWARE TA4903 DetectProvider Send Account Email Response (malware.rules)
- 2868690 - ETPRO MALWARE TA4903 DetectProvider Start Capture (malware.rules)
- 2868691 - ETPRO MALWARE TA4903 DetectProvider Start Capture Response (malware.rules)

* * *

## Modified inactive rules:

- 2868668 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868670 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)