# Ruleset Update Summary - 2026/10/20 - v11315 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 20, 2026, 8:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-20-v11315/3485 "2026-10-20T20:34:55Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 20, 2026, 8:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-10-20-v11315/3485/1 "2026-10-20T20:34:56Z")
## Summary: 13 new OPEN, 13 new PRO (13 + 0) * * * ## Added rules: ### Open: - 2072517 - ET MALWARE Matanbuchus CnC Tunneling Activity, Session Established, \* .microsoft .com variant (malware.rules) - 2072518 - ET MALWARE Matanbuchus CnC Tunneling Activity, DATA ACK (malware.rules) - 2072519 - ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, E Subdomain for Exfil (malware.rules) - 2072520 - ET MALWARE Matanbuchus CnC Tunneling Activity Inbound, Terminate Tunnel (malware.rules) - 2072521 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (groks .workers .dev) (malware.rules) - 2072522 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (groks .workers .dev) (malware.rules) - 2072523 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (ssp-prod .joelbauertraining .com) (malware.rules) - 2072524 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (ssp-prod .joelbauertraining .com) (malware.rules) - 2072525 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rbmlh .xyz) (malware.rules) - 2072526 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rbmlh .xyz) in TLS SNI (malware.rules) - 2072527 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (siltapl .fun) (malware.rules) - 2072528 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (siltapl .fun) in TLS SNI (malware.rules) - 2072529 - ET HUNTING Apache CouchDB Erlang RPC OS Command (hunting.rules) * * * ## Modified inactive rules: - 2867062 - ETPRO WEB\_SPECIFIC\_APPS Adobe Coldfusion Central Config Server (CCS) Directory Traversal (CVE-2026-27305) (web\_specific\_apps.rules)