# Ruleset Update Summary - 2023/12/26 - v10493 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-26-v10493/1234 **Category:** Ruleset Updates **Created:** [December 26, 2023, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-26-v10493/1234 "2023-12-26T21:49:11Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [December 26, 2023, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-12-26-v10493/1234/1 "2023-12-26T21:49:11Z")
## Summary: 25 new OPEN, 25 new PRO (25 + 0) * * * ## Added rules: ### Open: - 2049833 - ET PHISHING Lucy Security - Phishing Landing Page M3 (phishing.rules) - 2049834 - ET INFO Lucy Security - Awareness Landing Page M2 (info.rules) - 2049835 - ET PHISHING Lucy Security - Phishing to Awareness Landing Page (phishing.rules) - 2049836 - ET MALWARE Lumma Stealer Related Activity (malware.rules) - 2049837 - ET MALWARE Suspected PrivateLoader Activity (POST) (malware.rules) - 2049838 - ET MALWARE Observed Lumma Stealer Related Domain (agedelayglacierwe .pw in TLS SNI) (malware.rules) - 2049839 - ET MALWARE Lumma Stealer Related Domain in DNS Lookup (agedelayglacierwe .pw) (malware.rules) - 2049840 - ET INFO URI Shortening Service Domain in DNS Lookup (cli .re) (info.rules) - 2049841 - ET INFO Observed URI Shortening Service Domain (cli .re in TLS SNI) (info.rules) - 2049842 - ET MALWARE Lumma Stealer Related Domain in DNS Lookup (chincenterblandwka .pw) (malware.rules) - 2049843 - ET MALWARE Observed Lumma Stealer Related Domain (chincenterblandwka .pw in TLS SNI) (malware.rules) - 2049844 - ET MALWARE Lumma Stealer Related Domain in DNS Lookup (neighborhoodfeelsa .fun) (malware.rules) - 2049845 - ET MALWARE Observed Lumma Stealer Related Domain (neighborhoodfeelsa .fun in TLS SNI) (malware.rules) - 2049846 - ET MALWARE SocGholish CnC Domain in DNS Lookup (\* .places .creeksidehuntingpreserve .com) (malware.rules) - 2049847 - ET MALWARE SocGholish CnC Domain in TLS SNI (\* .places .creeksidehuntingpreserve .com) (malware.rules) - 2049848 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (proexbit .com) (exploit\_kit.rules) - 2049849 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (onlinesavingsjournal .com) (exploit\_kit.rules) - 2049850 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (proximaideia .com) (exploit\_kit.rules) - 2049851 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (realestateagentnorfolkvirginia .com) (exploit\_kit.rules) - 2049852 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (polatliems .com) (exploit\_kit.rules) - 2049853 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (proexbit .com) (exploit\_kit.rules) - 2049854 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (onlinesavingsjournal .com) (exploit\_kit.rules) - 2049855 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (proximaideia .com) (exploit\_kit.rules) - 2049856 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (realestateagentnorfolkvirginia .com) (exploit\_kit.rules) - 2049857 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (polatliems .com) (exploit\_kit.rules) * * * ## Disabled and modified rules: - 2029104 - ET MALWARE Win32/Snatch Ransomware - Encryption Finished (malware.rules) - 2029148 - ET MALWARE Win32/Unk.BrowserStealer Data Exfil M2 (malware.rules) - 2048311 - ET MALWARE Observed Malicious SSL Cert (Cobalt Strike) (malware.rules) - 2839523 - ETPRO MALWARE Win32/Metamorfo Style CnC Activity (malware.rules) - 2839626 - ETPRO MALWARE Win32/SageRunex CnC Activity (malware.rules) - 2839787 - ETPRO MALWARE Win32/Unk.Ransomware Retreiving External IP Address (malware.rules) - 2839876 - ETPRO MALWARE Win32/Cyborg Keylogger FTP STOR Command (malware.rules) - 2839878 - ETPRO MALWARE Win32/AgentTesla FTP STOR Command M2 (malware.rules) - 2839921 - ETPRO MALWARE Cyborg Keylogger Checkin via FTP (malware.rules) - 2839922 - ETPRO MALWARE Cyborg Keylogger FTP STOR Command (malware.rules) - 2839923 - ETPRO MALWARE Win32/Tdata Stealer CnC Checkin (malware.rules) - 2839954 - ETPRO MALWARE Win32/Aspire Stealer CnC Checkin (malware.rules) - 2840030 - ETPRO MALWARE Sifrelendi Ransomware Checkin via FTP (malware.rules) - 2840168 - ETPRO HUNTING Observed Powershell Keylogging Code Inbound (hunting.rules) - 2840169 - ETPRO MALWARE Win32/Various Ransomware CnC Activity (malware.rules) * * * ## Removed rules: - 2855505 - ETPRO MALWARE Lumma Stealer Related Activity (malware.rules)