# Ruleset Update Summary - 2023/10/10 - v10436 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 10, 2023, 7:42pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-10-v10436/1024 "2023-10-10T19:42:23Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 10, 2023, 7:42pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-10-v10436/1024/1 "2023-10-10T19:42:23Z")
## Summary: 27 new OPEN, 28 new PRO (27 + 1) Thanks @malware_traffic * * * ## Added rules: ### Open: - 2048507 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (basic .rethinkdns .com) (info.rules) - 2048508 - ET INFO LNK File Downloaded via HTTP (info.rules) - 2048509 - ET MALWARE Darkgate Stealer CnC Checkin (POST) (malware.rules) - 2048510 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns01 .flm9 .net) (info.rules) - 2048511 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (clientdns3 .softcom .net) (info.rules) - 2048512 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (irre .li) (info.rules) - 2048513 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (lastentarvike .fi) (info.rules) - 2048514 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .daw .dev) (info.rules) - 2048515 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (muli .stusta .mhn .de) (info.rules) - 2048516 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .hahnjo .de) (info.rules) - 2048517 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (doh .niyawe .de) (info.rules) - 2048518 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (cluster-1 .gac .edu) (info.rules) - 2048519 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns1 .in-berlin .de) (info.rules) - 2048520 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .clanless .ovh) (info.rules) - 2048521 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (cluster-0 .gac .edu) (info.rules) - 2048522 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (esel .stusta .mhn .de) (info.rules) - 2048523 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (timmes .nl) (info.rules) - 2048524 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (adguard .jfchenier .ca) (info.rules) - 2048525 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (ns .00dani .me) (info.rules) - 2048526 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (doth .huque .com) (info.rules) - 2048527 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .slinkyman .net) (info.rules) - 2048528 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (sky .rethinkdns .com) (info.rules) - 2048529 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (jackyes .ovh) (info.rules) - 2048530 - ET INFO Observed DNS over HTTPS Domain in TLS SNI (dns .fancyorg .at) (info.rules) - 2048531 - ET PHISHING MageCart 404 COOKIE\_ANNOT (phishing.rules) - 2048532 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (eastrenclouds .com) (exploit\_kit.rules) - 2048533 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (eastrenclouds .com) (exploit\_kit.rules) ### Pro: - 2855346 - ETPRO MALWARE TA577 Red Response (malware.rules) * * * ## Removed rules: - 2851065 - ETPRO INFO Observed DNS over HTTPS Domain in TLS SNI (basic .rethinkdns .com) (info.rules)