# Ruleset Update Summary - 2023/11/30 - v10476 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 30, 2023, 9:42pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-30-v10476/1172 "2023-11-30T21:42:51Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 30, 2023, 9:42pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-11-30-v10476/1172/1 "2023-11-30T21:42:51Z")
## Summary: 16 new OPEN, 16 new PRO (16 + 0) Thanks @_cpresearch_, @TalosSecurity * * * ## Added rules: ### Open: - 2049400 - ET WEB\_SERVER /etc/passwd Detected in URI (web\_server.rules) - 2049401 - ET WEB\_SERVER /etc/hosts Detected in URI (web\_server.rules) - 2049402 - ET WEB\_SERVER .bash\_history Detected in URI (web\_server.rules) - 2049403 - ET ATTACK\_RESPONSE Possible hosts File Output via HTTP (Windows Style) (attack\_response.rules) - 2049404 - ET ATTACK\_RESPONSE Possible hosts File Output via HTTP (Linux Style) (attack\_response.rules) - 2049405 - ET WEB\_SERVER Simple JSP WebShell Landing Page (web\_server.rules) - 2049406 - ET WEB\_SERVER vonloesch JSP File Browser (web\_server.rules) - 2049407 - ET MALWARE ToddyCat APT Related CurCore Activity (POST) (malware.rules) - 2049408 - ET MALWARE JynxLoaderV2 CnC Checkin (malware.rules) - 2049409 - ET MALWARE SugarGh0st RAT CnC Checkin (malware.rules) - 2049410 - ET MALWARE SugarGh0st RAT Domain in DNS Lookup (login .drive-google-com .tk) (malware.rules) - 2049411 - ET MALWARE SugarGh0st RAT Domain in DNS Lookup (account .drive-google-com .tk) (malware.rules) - 2049412 - ET MALWARE SocGholish Domain in DNS Lookup (dashboard .renovationsruth .com) (malware.rules) - 2049413 - ET MALWARE SocGholish Domain in TLS SNI (dashboard .renovationsruth .com) (malware.rules) - 2049414 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (paradoxmarine .com) (exploit\_kit.rules) - 2049415 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (paradoxmarine .com) (exploit\_kit.rules) * * * ## Modified inactive rules: - 2048044 - ET PHISHING [TW] Tycoon Phishkit Domain Observed (codecrafterspro .com) (phishing.rules) - 2048045 - ET PHISHING [TW] Tycoon Phishkit Domain Observed (codecrafters .su) (phishing.rules) - 2048046 - ET PHISHING [TW] Tycoon Phishkit Domain Observed (devcraftingsolutions .com) (phishing.rules) - 2048047 - ET PHISHING [TW] Tycoon Phishkit Domain (devcraftingsolutions .com in TLS SNI) (phishing.rules) - 2048048 - ET PHISHING [TW] Tycoon Phishkit Domain (codecrafterspro .com in TLS SNI) (phishing.rules) * * * ## Disabled and modified rules: - 2045875 - ET MALWARE SocGholish Domain in DNS Lookup (enterprise .alliantlaw .us) (malware.rules) - 2046946 - ET MALWARE SocGholish Domain in TLS SNI (content .garretttrails .org) (malware.rules) - 2048368 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (nilselsholz .com) (exploit\_kit.rules) - 2048369 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (nilselsholz .com) (exploit\_kit.rules)