# Ruleset Update Summary - 2026/09/30 - v11301

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-30-v11301/3470>\
**Category:** Ruleset Updates\
**Created:** [September 30, 2026, 9:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-30-v11301/3470 "2026-09-30T21:02:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [September 30, 2026, 9:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-09-30-v11301/3470/1 "2026-09-30T21:02:12Z")

</div>

## Summary:

10 new OPEN, 21 new PRO (10 + 11)

* * *

## Added rules:

### Open:

- 2072301 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (beacon .kraynov .org) (malware.rules)
- 2072302 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (ref-api .homefulia .com) (malware.rules)
- 2072303 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (beacon .kraynov .org) (malware.rules)
- 2072304 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (ref-api .homefulia .com) (malware.rules)
- 2072305 - ET INFO DYNAMIC\_DNS Query to a \*.coadautodoor .com domain (info.rules)
- 2072306 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.coadautodoor .com domain (info.rules)
- 2072307 - ET INFO DYNAMIC\_DNS Query to a \*.extratechsolutions .com domain (info.rules)
- 2072308 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.extratechsolutions .com domain (info.rules)
- 2072309 - ET INFO DYNAMIC\_DNS Query to a \*.gz-associates .com domain (info.rules)
- 2072310 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.gz-associates .com domain (info.rules)

### Pro:

- 2868719 - ETPRO MALWARE CLoader CnC Fetch Payload (malware.rules)
- 2868720 - ETPRO MALWARE CLoader CnC Run Command M1 (malware.rules)
- 2868721 - ETPRO MALWARE CLoader CnC Run Command M2 (malware.rules)
- 2868722 - ETPRO EXPLOIT Citrix DTLSv1.0 Unauthenticated Buffer Overflow (CVE-2026-88772) (exploit.rules)
- 2868723 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2868724 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2868725 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2868726 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2868727 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2868728 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2868729 - ETPRO MALWARE TA406 CnC Activity (Beacon) (malware.rules)