# Ruleset Update Summary - 2026/10/14 - v11311

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-14-v11311/3480>\
**Category:** Ruleset Updates\
**Created:** [October 14, 2026, 9:11pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-14-v11311/3480 "2026-10-14T21:11:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [October 14, 2026, 9:11pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-14-v11311/3480/1 "2026-10-14T21:11:38Z")

</div>

## Summary:

6 new OPEN, 27 new PRO (6 + 21)

* * *

## Added rules:

### Open:

- 2072446 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (testing .0b3l1sk .me) (malware.rules)
- 2072447 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (testing .0b3l1sk .me) in TLS SNI (malware.rules)
- 2072448 - ET HUNTING PowerShell Request to cdn .jsdelivr .net (hunting.rules)
- 2072449 - ET EXPLOIT\_KIT BlueMoon Exploit Kit Status Callback (exploit\_kit.rules)
- 2072450 - ET EXPLOIT\_KIT BlueMoon Exploit Kit Worker Binary Payload (exploit\_kit.rules)
- 2072451 - ET EXPLOIT\_KIT BlueMoon Exploit Kit Non-Worker Fallback Binary Payload (exploit\_kit.rules)

### Pro:

- 2868799 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware GitHub Actions Workflow (malware.rules)
- 2868800 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
- 2868801 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
- 2868802 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M1 (malware.rules)
- 2868803 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M2 (malware.rules)
- 2868804 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Commit Marker Search M3 (malware.rules)
- 2868805 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M1 (malware.rules)
- 2868806 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M2 (malware.rules)
- 2868807 - ETPRO MALWARE Shai-Hulud NPM Malware CnC Exfiltration Header M3 (malware.rules)
- 2868808 - ETPRO MALWARE Shai-Hulud (The Third Coming) NPM Malware Github Repository Creation (malware.rules)
- 2868809 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2868810 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2868811 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2868812 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2868813 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2868814 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2868815 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2868816 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2868817 - ETPRO MALWARE TA402 CnC Fetch New Google OAuth Token (malware.rules)
- 2868818 - ETPRO MALWARE TA402 CnC Exfil Host Info (malware.rules)
- 2868819 - ETPRO MALWARE TA402 CnC Poll for Commands (malware.rules)

* * *

## Disabled and modified rules:

- 2072335 - ET MALWARE Observed DNS Query to ClickFix Domain (gateway .tenderly .co) (malware.rules)
- 2072346 - ET MALWARE Observed ClickFix Domain (gateway .tenderly .co in TLS SNI) (malware.rules)