# Ruleset Update Summary - 2026/11/04 - v11327 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 4, 2026, 9:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-11-04-v11327/3499 "2026-11-04T21:34:56Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 4, 2026, 9:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2026-11-04-v11327/3499/1 "2026-11-04T21:34:56Z")
## Summary: 6 new OPEN, 15 new PRO (6 + 9) * * * ## Added rules: ### Open: - 2072633 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-connects .com) (malware.rules) - 2072634 - ET MALWARE TryNodeRAT CnC Domain in DNS Lookup (relays-cf .workersp .dev) (malware.rules) - 2072635 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-connects .com) (malware.rules) - 2072636 - ET MALWARE TryNodeRAT CnC Domain in TLS SNI (relays-cf .workersp .dev) (malware.rules) - 2072637 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (img3 .centovinipolska .com) (malware.rules) - 2072638 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (img3 .centovinipolska .com) (malware.rules) ### Pro: - 2869026 - ETPRO EXPLOIT Quest KACE System Management Appliance Unauthenticated Command Injection (CVE-2018-11138) (exploit.rules) - 2869027 - ETPRO EXPLOIT Quest KACE System Management Appliance Authenticated Command Injection (CVE-2018-11139) (exploit.rules) - 2869028 - ETPRO EXPLOIT Quest KACE System Management Appliance Authentication Bypass (CVE-2018-11142) M1 (exploit.rules) - 2869029 - ETPRO EXPLOIT Quest KACE System Management Appliance Authentication Bypass (CVE-2018-11142) M2 (exploit.rules) - 2869030 - ETPRO HUNTING SAP Solution Manager (SolMan) Vulnerable Server Probe (CVE-2020-6207) (hunting.rules) - 2869031 - ETPRO EXPLOIT SAP Solution Manager (SolMan) Server-side Request Forgery (CVE-2020-6207) (exploit.rules) - 2869032 - ETPRO HUNTING WEBP VP8L Suspicious Padding M1 (hunting.rules) - 2869033 - ETPRO HUNTING WEBP VP8L Suspicious Padding M2 (hunting.rules) - 2869034 - ETPRO MALWARE Grandoreiro CnC Activity (GET) (malware.rules)