# Ruleset Update Summary - 2026/09/22 - v11295

**URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-22-v11295/3460
**Category:** Ruleset Updates
**Created:** [September 22, 2026, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-22-v11295/3460 "2026-09-22T20:41:14Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)
#### Post date: [September 22, 2026, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-22-v11295/3460/1 "2026-09-22T20:41:14Z")

</div>

## Summary:

34 new OPEN, 40 new PRO (34 + 6)

Thanks @skocherhan

* * *

## Added rules:

### Open:

- 2072125 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img2 .aixpirts .com) (malware.rules)
- 2072126 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (impact .hjdeboer .com) (malware.rules)
- 2072127 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (rs-api .50adayplan .com) (malware.rules)
- 2072128 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img2 .aixpirts .com) (malware.rules)
- 2072129 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (impact .hjdeboer .com) (malware.rules)
- 2072130 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (rs-api .50adayplan .com) (malware.rules)
- 2072131 - ET EXPLOIT\_KIT Observed DNS Query to ClickFix Domain (supplypopfiletoday .monster) (exploit\_kit.rules)
- 2072132 - ET EXPLOIT\_KIT Observed DNS Query to ClickFix Domain (informal4u .com) (exploit\_kit.rules)
- 2072133 - ET EXPLOIT\_KIT Observed ClickFix Domain (supplypopfiletoday .monster in TLS SNI) (exploit\_kit.rules)
- 2072134 - ET EXPLOIT\_KIT Observed ClickFix Domain (informal4u .com in TLS SNI) (exploit\_kit.rules)
- 2072135 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (bilfojsclod .beer) (exploit\_kit.rules)
- 2072136 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (bootstrup-cdnmaper .beer) (exploit\_kit.rules)
- 2072137 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (fontawesome-js-cdn .beer) (exploit\_kit.rules)
- 2072138 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (frameworkjsbns .beer) (exploit\_kit.rules)
- 2072139 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (lckcdnjs .beer) (exploit\_kit.rules)
- 2072140 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (lndteam .beer) (exploit\_kit.rules)
- 2072141 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (lsnsdns .beer) (exploit\_kit.rules)
- 2072142 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (npanssltejs .beer) (exploit\_kit.rules)
- 2072143 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (ns1cdnclaude .beer) (exploit\_kit.rules)
- 2072144 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (sns-clauder-cdn .beer) (exploit\_kit.rules)
- 2072145 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (visual-ns-portal .beer) (exploit\_kit.rules)
- 2072146 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (wpteamcdn .beer) (exploit\_kit.rules)
- 2072147 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (bilfojsclod .beer) (exploit\_kit.rules)
- 2072148 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (bootstrup-cdnmaper .beer) (exploit\_kit.rules)
- 2072149 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (fontawesome-js-cdn .beer) (exploit\_kit.rules)
- 2072150 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (frameworkjsbns .beer) (exploit\_kit.rules)
- 2072151 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (lckcdnjs .beer) (exploit\_kit.rules)
- 2072152 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (lndteam .beer) (exploit\_kit.rules)
- 2072153 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (lsnsdns .beer) (exploit\_kit.rules)
- 2072154 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (npanssltejs .beer) (exploit\_kit.rules)
- 2072155 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (ns1cdnclaude .beer) (exploit\_kit.rules)
- 2072156 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (sns-clauder-cdn .beer) (exploit\_kit.rules)
- 2072157 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (visual-ns-portal .beer) (exploit\_kit.rules)
- 2072158 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (wpteamcdn .beer) (exploit\_kit.rules)

### Pro:

- 2868692 - ETPRO MALWARE RedHiveStealer Payload Request M1 (malware.rules)
- 2868693 - ETPRO MALWARE RedHiveStealer Payload Request M2 (malware.rules)
- 2868694 - ETPRO MALWARE RedHiveStealer Payload Request M3 (malware.rules)
- 2868695 - ETPRO MALWARE RedHiveStealer CnC Checkin via TCP (malware.rules)
- 2868696 - ETPRO MALWARE RedHiveStealer CnC Respnose (auth\_ok) (malware.rules)
- 2868697 - ETPRO MALWARE RedHiveStealer CnC Exfil via TCP (malware.rules)