# Ruleset Update Summary - 2023/10/13 - v10439 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 13, 2023, 9:32pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-13-v10439/1037 "2023-10-13T21:32:45Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 13, 2023, 9:32pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-13-v10439/1037/1 "2023-10-13T21:32:45Z")
## Summary: 11 new OPEN, 12 new PRO (11 + 1) Thanks @malware_traffic, @Jane\_0sint * * * ## Added rules: ### Open: - 2048557 - ET WEB\_SERVER Generic PHP Webshell Activity (web\_server.rules) - 2048558 - ET MALWARE [ANY.RUN] DarkGate Check-In HTTP Header (POST) (malware.rules) - 2048559 - ET PHISHING DNS Query to TOAD Domain (300005 .ru) (phishing.rules) - 2048560 - ET PHISHING DNS Query to TOAD Domain (helpset123 .site) (phishing.rules) - 2048561 - ET PHISHING Observed TOAD Domain (300005 .ru in TLS SNI) (phishing.rules) - 2048562 - ET PHISHING Observed TOAD Domain (helpset123 .site in TLS SNI) (phishing.rules) - 2048563 - ET MALWARE Win32/DarkWatchMan Checkin Activity (POST) M2 (malware.rules) - 2048564 - ET USER\_AGENTS Possible Win32/DarkWatchMan User Agent M2 (user\_agents.rules) - 2048565 - ET USER\_AGENTS Possible Win32/DarkWatchMan User Agent M1 (user\_agents.rules) - 2048566 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (climedballon .org) (exploit\_kit.rules) - 2048567 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (climedballon .org) (exploit\_kit.rules) ### Pro: - 2855359 - ETPRO INFO PenTesting Related Domain in DNS Lookup (info.rules) * * * ## Modified inactive rules: - 2000006 - ET DOS Cisco Router HTTP DoS (dos.rules) * * * ## Disabled and modified rules: - 2048469 - ET CURRENT\_EVENTS Possible Atlassian Confluence CVE-2023-22515 Scan Activity (current\_events.rules) - 2048470 - ET CURRENT\_EVENTS Possible Atlassian Confluence CVE-2023-22515 Scan Activity (current\_events.rules)