# Ruleset Update Summary - 2026/10/13 - v11310

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-13-v11310/3479>\
**Category:** Ruleset Updates\
**Created:** [October 13, 2026, 9:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-13-v11310/3479 "2026-10-13T21:02:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [October 13, 2026, 9:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-13-v11310/3479/1 "2026-10-13T21:02:04Z")

</div>

## Summary:

19 new OPEN, 39 new PRO (19 + 20)

* * *

## Added rules:

### Open:

- 2072427 - ET WEB\_SERVER Ivanti Connect Secure Authentication Bypass (CVE-2026-104935) (web\_server.rules)
- 2072428 - ET WEB\_SPECIFIC\_APPS Tenda F456 Router Page Parameter Buffer Overflow (CVE-2026-9389) (web\_specific\_apps.rules)
- 2072429 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (tools .studerandson .com) (malware.rules)
- 2072430 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (tools .studerandson .com) (malware.rules)
- 2072431 - ET WEB\_SPECIFIC\_APPS CraftCMS element-search typecastBeforeSave Remote Code Execution Attempt (CVE-2026-44011) (web\_specific\_apps.rules)
- 2072432 - ET WEB\_SPECIFIC\_APPS TRENDnet formTcpipSetup name Parameter Buffer Overflow Attempt (CVE-2026-109157) (web\_specific\_apps.rules)
- 2072433 - ET WEB\_SPECIFIC\_APPS TRENDnet formWlanSetup enrollee Parameter Command Injection Attempt (CVE-2026-10182) (web\_specific\_apps.rules)
- 2072434 - ET WEB\_SPECIFIC\_APPS TRENDnet formWlanSetup enrollee Parameter Buffer Overflow Attempt (CVE-2026-10183) (web\_specific\_apps.rules)
- 2072435 - ET WEB\_SPECIFIC\_APPS GitLab Unauthenticated Arbitrary File Read (CVE-2026-85706) (web\_specific\_apps.rules)
- 2072436 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (foundations .bond) (malware.rules)
- 2072437 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (ncsgo .workers .dev) (malware.rules)
- 2072438 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (mcfind .workers .dev) (malware.rules)
- 2072439 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (tesso2 .workers .dev) (malware.rules)
- 2072440 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (zkffh-amilok .workers .dev) (malware.rules)
- 2072441 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (foundations .bond) (malware.rules)
- 2072442 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (ncsgo .workers .dev) (malware.rules)
- 2072443 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (mcfind .workers .dev) (malware.rules)
- 2072444 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (tesso2 .workers .dev) (malware.rules)
- 2072445 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (zkffh-amilok .workers .dev) (malware.rules)

### Pro:

- 2868779 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868780 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868781 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868782 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868783 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868784 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868785 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868786 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868787 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868788 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868789 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868790 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868791 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868792 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868793 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868794 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868795 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2868796 - ETPRO MALWARE MasqradFix Web Inject Observed (malware.rules)
- 2868797 - ETPRO MALWARE MasqradFix Web Inject Payload Request (malware.rules)
- 2868798 - ETPRO MALWARE MasqradFix Host Profile Exfil (malware.rules)