# Ruleset Update Summary - 2023/11/06 - v10458 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 6, 2023, 10:00pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-06-v10458/1095 "2023-11-06T22:00:46Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 6, 2023, 10:00pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-06-v10458/1095/1 "2023-11-06T22:00:46Z")
## Summary: 16 new OPEN, 17 new PRO (16 + 1) Thanks @Unit42\_Intel * * * ## Added rules: ### Open: - 2049080 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M1 Version 1.x-6.x (web\_specific\_apps.rules) - 2049081 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected M2 Version 1.x-6.x (web\_specific\_apps.rules) - 2049082 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 8.x M1 (web\_specific\_apps.rules) - 2049083 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 8.x M2 (web\_specific\_apps.rules) - 2049084 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 7.x M1 (web\_specific\_apps.rules) - 2049085 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence CVE-2023-22518 Vulnerable Server Detected Version 7.x M2 (web\_specific\_apps.rules) - 2049086 - ET MALWARE JS/Z1\_Loader Activity (POST) (malware.rules) - 2049087 - ET MALWARE Win32/Stealc Style Headers In HTTP POST (malware.rules) - 2049088 - ET PHISHING Possible SWAT USA Drop Login Panel (phishing.rules) - 2049089 - ET EXPLOIT\_KIT Keitaro Set-Cookie Inbound to RogueRaticate (7fcd2) (exploit\_kit.rules) - 2049090 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (andreeasasser .com) (exploit\_kit.rules) - 2049091 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (addisonlynch .com) (exploit\_kit.rules) - 2049092 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (andreeasasser .com) (exploit\_kit.rules) - 2049093 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (addisonlynch .com) (exploit\_kit.rules) - 2049094 - ET EXPLOIT\_KIT RogueRaticate Domain in DNS Lookup (izikatka0010 .com) (exploit\_kit.rules) - 2049095 - ET EXPLOIT\_KIT RogueRaticate Domain in TLS SNI (izikatka0010 .com) (exploit\_kit.rules) ### Pro: - 2855525 - ETPRO MALWARE Win32/Stealc Host Details Exfil (POST) (malware.rules) * * * ## Modified inactive rules: - 2048581 - ET CURRENT\_EVENTS Possible Atlassian Confluence CVE-2023-22515 Scan Activity - Clone (current\_events.rules)