# Ruleset Update Summary - 2023/08/28 - v10404 **URL:** \ **Category:** Ruleset Updates\ **Created:** [August 28, 2023, 9:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-28-v10404/902 "2023-08-28T21:06:16Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [August 28, 2023, 9:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-28-v10404/902/1 "2023-08-28T21:06:16Z")
## Summary: 43 new OPEN, 46 new PRO (43 + 3) Thanks @rmceoin * * * ## Added rules: ### Open: - 2047766 - ET INFO DNS Query for Webhook/HTTP Request Inspection/Tunneling Service (.free .beeceptor .com) (info.rules) - 2047767 - ET INFO Webhook/HTTP Request Inspection/Tunneling Service Domain (.free .beeceptor .com in TLS SNI) (info.rules) - 2047768 - ET INFO DNS Query for Webhook/HTTP Request Inspection Service (.curlhub .io) (info.rules) - 2047769 - ET INFO Webhook/HTTP Request Inspection Service Domain (.curlhub .io in TLS SNI) (info.rules) - 2047770 - ET INFO DNS Query for Webhook/HTTP Request Inspection Service (.apiary-mock .com) (info.rules) - 2047771 - ET INFO Webhook/HTTP Request Inspection Service Domain (.apiary-mock .com in TLS SNI) (info.rules) - 2047772 - ET INFO DNS Query for Webhook/HTTP Request Inspection Service (requestbin .cn) (info.rules) - 2047773 - ET INFO HTTP Request to Webhook/HTTP Request Inspection Service Domain (requestbin .cn) (info.rules) - 2047774 - ET INFO Interactsh Domain in DNS Lookup (.oast .me) (info.rules) - 2047775 - ET INFO Interactsh Domain in DNS Lookup (.oast .site) (info.rules) - 2047776 - ET INFO Interactsh Domain (.oast .site in TLS SNI) (info.rules) - 2047777 - ET INFO Interactsh Domain in DNS Lookup (.oast .live) (info.rules) - 2047778 - ET INFO Interactsh Domain (.oast .live in TLS SNI) (info.rules) - 2047779 - ET INFO Interactsh Domain in DNS Lookup (.oast .pro) (info.rules) - 2047780 - ET INFO Interactsh Domain (.oast .pro in TLS SNI) (info.rules) - 2047781 - ET INFO Interactsh Domain in DNS Lookup (.oast .online) (info.rules) - 2047782 - ET INFO Interactsh Domain (.oast .online in TLS SNI) (info.rules) - 2047783 - ET INFO Interactsh Domain in DNS Lookup (.oast .fun) (info.rules) - 2047784 - ET INFO Interactsh Domain (.oast .fun in TLS SNI) (info.rules) - 2047785 - ET INFO Interactsh Domain (.oast .me in TLS SNI) (info.rules) - 2047786 - ET HUNTING Base64 Encoded RAR File in HTML Body (Magic Bytes) (hunting.rules) - 2047787 - ET HUNTING Base64 Encoded zip-compressed File in HTML Body (Mime Type) (hunting.rules) - 2047788 - ET HUNTING Base64 Encoded ISO File in HTML Body (Magic Bytes) (hunting.rules) - 2047789 - ET HUNTING Base64 Encoded RAR Compressed File in HTML Body (Mime Type) (hunting.rules) - 2047790 - ET HUNTING Base64 Encoded octet-stream File in HTML Body (Mime Type) (hunting.rules) - 2047791 - ET HUNTING Base64 Encoded Null Byte Padded File in HTML Body (Magic Bytes) (hunting.rules) - 2047792 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (adqdqqewqewplzoqmzq .site) (exploit\_kit.rules) - 2047793 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (borbrbmrtxtrbxrq .site) (exploit\_kit.rules) - 2047794 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (komomjinndqndqwf .store ) (exploit\_kit.rules) - 2047795 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (omdowqind .site) (exploit\_kit.rules) - 2047796 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (wffewiuofegwumzowefmgwezfzew .site) (exploit\_kit.rules) - 2047797 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (wnimodmoiejn .site) (exploit\_kit.rules) - 2047798 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (adqdqqewqewplzoqmzq .site) (exploit\_kit.rules) - 2047799 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (borbrbmrtxtrbxrq .site) (exploit\_kit.rules) - 2047800 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (komomjinndqndqwf .store ) (exploit\_kit.rules) - 2047801 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (omdowqind .site) (exploit\_kit.rules) - 2047802 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (wffewiuofegwumzowefmgwezfzew .site) (exploit\_kit.rules) - 2047803 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (wnimodmoiejn .site) (exploit\_kit.rules) - 2047804 - ET EXPLOIT\_KIT Keitaro Set-Cookie Inbound to ClearFake (71eb8) (exploit\_kit.rules) - 2047805 - ET EXPLOIT\_KIT Fake Browser Update Domain in DNS Lookup (martinreamask .com) (exploit\_kit.rules) - 2047806 - ET EXPLOIT\_KIT Fake Browser Update Domain in DNS Lookup (seyishalom .com) (exploit\_kit.rules) - 2047807 - ET EXPLOIT\_KIT Fake Browser Update Domain in TLS SNI (martinreamask .com) (exploit\_kit.rules) - 2047808 - ET EXPLOIT\_KIT Fake Browser Update Domain in TLS SNI (seyishalom .com) (exploit\_kit.rules) ### Pro: - 2855184 - ETPRO PHISHING Zimbra Phish Landing Page 2023-08-28 (phishing.rules) - 2855185 - ETPRO CURRENT\_EVENTS Commonly Abused Domain Domain in DNS Lookup (current\_events.rules) - 2855186 - ETPRO CURRENT\_EVENTS Observed Commonly Abused Domain in TLS SNI (current\_events.rules)