# Ruleset Update Summary - 2026/10/12 - v11309

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-12-v11309/3478>\
**Category:** Ruleset Updates\
**Created:** [October 12, 2026, 9:20pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-12-v11309/3478 "2026-10-12T21:20:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [October 12, 2026, 9:20pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-12-v11309/3478/1 "2026-10-12T21:20:40Z")

</div>

## Summary:

17 new OPEN, 21 new PRO (17 + 4)

* * *

## Added rules:

### Open:

- 2072410 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reliabledmwqj .shop) (malware.rules)
- 2072411 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reliabledmwqj .shop) in TLS SNI (malware.rules)
- 2072412 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (prod-static .nascarnash .com) (malware.rules)
- 2072413 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (prod-static .nascarnash .com) (malware.rules)
- 2072414 - ET ADWARE\_PUP Request For Third-Party Windows Activation Script (adware\_pup.rules)
- 2072415 - ET MALWARE Generic PowerShell Loader Payload Request (malware.rules)
- 2072416 - ET MALWARE Observed DNS Query to Generic Powershell Loader Payload Domain (conti .pk) (malware.rules)
- 2072417 - ET MALWARE Observed Generic Powershell Loader Payload Domain (conti .pk in TLS SNI) (malware.rules)
- 2072418 - ET ADWARE\_PUP Observed DNS Query to Windows Activation Script Domain (get .activated .win) (adware\_pup.rules)
- 2072419 - ET ADWARE\_PUP Observed Windows Activation Script Domain (get .activated .win in TLS SNI) (adware\_pup.rules)
- 2072420 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (fins .workers .dev) (malware.rules)
- 2072421 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (nffnj .workers .dev) (malware.rules)
- 2072422 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (filedu .workers .dev) (malware.rules)
- 2072423 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (fins .workers .dev) (malware.rules)
- 2072424 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (nffnj .workers .dev) (malware.rules)
- 2072425 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (filedu .workers .dev) (malware.rules)
- 2072426 - ET HUNTING Fake Windows User-Agent Observed (hunting.rules)

### Pro:

- 2868775 - ETPRO HUNTING Observed Javascript Obfuscation CharCode for atob and document (hunting.rules)
- 2868776 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)
- 2868777 - ETPRO MALWARE MasqradFix Payload Embedded Within PNG (malware.rules)
- 2868778 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)