# Ruleset Update Summary - 2023/11/08 - v10461

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-08-v10461/1105>\
**Category:** Ruleset Updates\
**Created:** [November 8, 2023, 10:00pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-08-v10461/1105 "2023-11-08T22:00:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 8, 2023, 10:00pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-08-v10461/1105/1 "2023-11-08T22:00:33Z")

</div>

## Summary:

11 new OPEN, 14 new PRO (11 + 3)

Thanks @zscaler

* * *

## Added rules:

### Open:

- 2049118 - ET EXPLOIT D-Link TRENDnet NCC Service Command Injection Attempt (CVE-2015-1187) (exploit.rules)
- 2049119 - ET EXPLOIT D-Link DSL-2750B Command Injection Attempt (CVE-2016-20017) (exploit.rules)
- 2049120 - ET EXPLOIT Korenix JetWave formSysCmd Command Injection Attempt (CVE-2016-20017) (exploit.rules)
- 2049121 - ET EXPLOIT Totolink Command Injection Attempt (CVE-2020-40475) (exploit.rules)
- 2049122 - ET MALWARE Bandit Stealer Config Inbound (malware.rules)
- 2049123 - ET MALWARE Bandit Stealer Host Details Exfil (malware.rules)
- 2049124 - ET HUNTING HTTP GET Request for AutoItX3 (hunting.rules)
- 2049125 - ET MALWARE SocGholish CnC Domain in DNS Lookup (\* .caching .oysterfloats .com) (malware.rules)
- 2049126 - ET MALWARE SocGholish CnC Domain in TLS SNI (\* .caching .oysterfloats .com) (malware.rules)
- 2049127 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (limeerror .org) (exploit\_kit.rules)
- 2049128 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (limeerror .org) (exploit\_kit.rules)

### Pro:

- 2855533 - ETPRO MALWARE LockBit Domain in DNS Lookup (malware.rules)
- 2855534 - ETPRO MALWARE Observed LockBit Domain in TLS SNI (malware.rules)
- 2855535 - ETPRO MALWARE LockBit CnC Activity (POST) (malware.rules)

* * *

## Disabled and modified rules:

- 2047925 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (marcborowy .com) (exploit\_kit.rules)
- 2047926 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (marcborowy .com) (exploit\_kit.rules)
- 2047933 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (oekofkkfkoeefkefbnhgtrq .space) (exploit\_kit.rules)
- 2047934 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (gkrokbmrkmrxtmxrxr .space) (exploit\_kit.rules)
- 2047935 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (znqjdnqzdqzfqmfqmkfq .site) (exploit\_kit.rules)
- 2047936 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (owkdzodqzodqjefjnnejenefe .site) (exploit\_kit.rules)
- 2047937 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (oekofkkfkoeefkefbnhgtrq .space) (exploit\_kit.rules)
- 2047938 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (gkrokbmrkmrxtmxrxr .space) (exploit\_kit.rules)
- 2047939 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (znqjdnqzdqzfqmfqmkfq .site) (exploit\_kit.rules)
- 2047940 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (owkdzodqzodqjefjnnejenefe .site) (exploit\_kit.rules)
- 2047941 - ET EXPLOIT\_KIT RogueRaticate Domain in DNS Lookup (gctatick .com) (exploit\_kit.rules)
- 2047942 - ET EXPLOIT\_KIT RogueRaticate Domain in TLS SNI (gctatick .com) (exploit\_kit.rules)
- 2047943 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (xxxmir .info) (exploit\_kit.rules)
- 2047944 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (xxxmir .info) (exploit\_kit.rules)
- 2047988 - ET MALWARE SocGholish CnC Domain in DNS Lookup (\* .2023 .ebeenj .com) (malware.rules)
- 2047989 - ET MALWARE SocGholish CnC Domain in TLS SNI (\* .2023 .ebeenj .com) (malware.rules)
- 2047990 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (oiuytyfvq621mb .org) (exploit\_kit.rules)
- 2047991 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (oiuytyfvq621mb .org) (exploit\_kit.rules)