# Ruleset Update Summary - 2026/11/02 - v11325

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2026-11-02-v11325/3497>\
**Category:** Ruleset Updates\
**Created:** [November 2, 2026, 9:35pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-11-02-v11325/3497 "2026-11-02T21:35:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 2, 2026, 9:35pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-11-02-v11325/3497/1 "2026-11-02T21:35:24Z")

</div>

## Summary:

13 new OPEN, 24 new PRO (13 + 11)

* * *

## Added rules:

### Open:

- 2072612 - ET MALWARE Redhive Staging Domain in TLS SNI (gitrm .sbs) (malware.rules)
- 2072613 - ET MALWARE Redhive Staging Domain in TLS SNI (gitsl .xyz) (malware.rules)
- 2072614 - ET MALWARE Redhive Staging Domain in TLS SNI (gitview .sbs) (malware.rules)
- 2072615 - ET MALWARE Redhive Staging Domain in TLS SNI (viewgit .sbs) (malware.rules)
- 2072616 - ET INFO DYNAMIC\_DNS Query to a \*.chiemtinhviet .com domain (info.rules)
- 2072617 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.chiemtinhviet .com domain (info.rules)
- 2072618 - ET INFO DYNAMIC\_DNS Query to a \*.9dejulio .gob .ar domain (info.rules)
- 2072619 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.9dejulio .gob .ar domain (info.rules)
- 2072620 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rosaryconbo .fun) (malware.rules)
- 2072621 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rosaryconbo .fun) in TLS SNI (malware.rules)
- 2072622 - ET WEB\_SPECIFIC\_APPS Joomla Improper Access Control to Webservice Endpoints M2 (CVE-2023-23752) (web\_specific\_apps.rules)
- 2072623 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (atl-ut .cannabisrootshub .com) (malware.rules)
- 2072624 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (atl-ut .cannabisrootshub .com) (malware.rules)

### Pro:

- 2869005 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2869006 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2869007 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2869008 - ETPRO MALWARE TA584 Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2869009 - ETPRO MALWARE TA584 Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2869010 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2869011 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2869012 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2869013 - ETPRO MALWARE TA584 Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2869014 - ETPRO MALWARE Hermes MaaS User-Agent Observed (malware.rules)
- 2869015 - ETPRO MALWARE Hermes MaaS User-Agent Observed (malware.rules)

* * *

## Disabled and modified rules:

- 2868894 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (gitrm .cfd) (malware.rules)

* * *

## Removed rules:

- 2868896 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
- 2868897 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
- 2868898 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (malware.rules)
- 2868996 - ETPRO MALWARE Redhive Staging Domain in TLS SNI (gitrm .sbs) (malware.rules)