# Ruleset Update Summary - 2024/07/09 - v10641 **URL:** \ **Category:** Ruleset Updates\ **Created:** [July 9, 2024, 11:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-09-v10641/1809 "2024-07-09T23:06:37Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [July 9, 2024, 11:06pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-09-v10641/1809/1 "2024-07-09T23:06:37Z")
## Summary: 18 new OPEN, 29 new PRO (18 + 11) Thanks @herrcore, @Jane\_0sint * * * ## Added rules: ### Open: - 2037082 - ET MALWARE Possible Follina Payload Delivery Page (malware.rules) - 2054407 - ET INFO Server Responded with Vulnerable OpenSSH Version (CVE-2024-6409) (info.rules) - 2054408 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (aestheticainteriors .com) (exploit\_kit.rules) - 2054409 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (aestheticainteriors .com) (exploit\_kit.rules) - 2054410 - ET EXPLOIT Splunk Unauthenticated Path Traversal Attempt Inbound (CVE-2024-36991) (exploit.rules) - 2054411 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (eternosrelojeria .com) (exploit\_kit.rules) - 2054412 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (eternosrelojeria .com) (exploit\_kit.rules) - 2054413 - ET MALWARE ZharkBot User-Agent Observed (malware.rules) - 2054414 - ET MALWARE ZharkBot CnC Exfil in HTTP URI (malware.rules) - 2054415 - ET MALWARE ZharkBot CnC Domain in DNS Lookup (warzone-meta .net) (malware.rules) - 2054416 - ET MALWARE ZharkBot CnC Domain in DNS Lookup (solutionhub .cc) (malware.rules) - 2054417 - ET MALWARE Observed ZharkBot Domain (warzone-meta .net in TLS SNI) (malware.rules) - 2054418 - ET MALWARE Observed ZharkBot Domain (solutionhub .cc in TLS SNI) (malware.rules) - 2054419 - ET MALWARE [ANY.RUN] MetaStealer v.5 (MC-NMF TLS Server Certificate) (malware.rules) - 2054420 - ET INFO DYNAMIC\_DNS Query to a \*. .lasboleras .com Domain (info.rules) - 2054421 - ET INFO DYNAMIC\_DNS HTTP Request to a \*. .lasboleras .com Domain (info.rules) - 2054422 - ET INFO Referrer-Policy set to unsafe-url (info.rules) - 2054423 - ET HUNTING TinyURL to Netlify Redirect (hunting.rules) ### Pro: - 2857528 - ETPRO MALWARE Win32/Generic Host Exfil (malware.rules) - 2857529 - ETPRO MALWARE Blackmoon CnC Checkin (malware.rules) - 2857530 - ETPRO INFO Google API Redirect Using additnow Service (info.rules) - 2857551 - ETPRO EXPLOIT\_KIT Evil Keitaro Set-Cookie Inbound (exploit\_kit.rules) - 2857552 - ETPRO EXPLOIT\_KIT Evil Keitaro Set-Cookie Inbound (exploit\_kit.rules) - 2857553 - ETPRO EXPLOIT\_KIT Evil Keitaro Set-Cookie Inbound (exploit\_kit.rules) - 2857554 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2857555 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2857556 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2857557 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2857558 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) * * * ## Disabled and modified rules: - 2052313 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (dinets .best) (exploit\_kit.rules) - 2052314 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (dinets .best) (exploit\_kit.rules) - 2052327 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (wsj .wf) (exploit\_kit.rules) - 2052328 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (wsj .re) (exploit\_kit.rules) - 2052329 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (wsj .pm) (exploit\_kit.rules) - 2052330 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (wsj .wales) (exploit\_kit.rules) - 2052331 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (concur .pm) (exploit\_kit.rules) - 2052332 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (concur .re) (exploit\_kit.rules) - 2052333 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (concur .cfd) (exploit\_kit.rules) - 2052334 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (meet-go .click) (exploit\_kit.rules) - 2052335 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (blackrock .wf) (exploit\_kit.rules) - 2052336 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (blackrock .re) (exploit\_kit.rules) - 2052337 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (meet-go .org) (exploit\_kit.rules) - 2052338 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (meet-go .link) (exploit\_kit.rules) - 2052339 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (asana .tel) (exploit\_kit.rules) - 2052340 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (asana .wf) (exploit\_kit.rules) - 2052341 - ET EXPLOIT\_KIT Malicious Google Ad Domain in DNS Lookup (asana .pm) (exploit\_kit.rules) - 2052342 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (wsj .wf) (exploit\_kit.rules) - 2052343 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (wsj .re) (exploit\_kit.rules) - 2052344 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (wsj .pm) (exploit\_kit.rules) - 2052345 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (wsj .wales) (exploit\_kit.rules) - 2052346 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (concur .pm) (exploit\_kit.rules) - 2052347 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (concur .re) (exploit\_kit.rules) - 2052348 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (concur .cfd) (exploit\_kit.rules) - 2052349 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (meet-go .click) (exploit\_kit.rules) - 2052350 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (blackrock .wf) (exploit\_kit.rules) - 2052351 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (blackrock .re) (exploit\_kit.rules) - 2052352 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (meet-go .org) (exploit\_kit.rules) - 2052353 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (meet-go .link) (exploit\_kit.rules) - 2052354 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (asana .tel) (exploit\_kit.rules) - 2052355 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (asana .wf) (exploit\_kit.rules) - 2052356 - ET EXPLOIT\_KIT Malicious Google Ad Domain in TLS SNI (asana .pm) (exploit\_kit.rules) - 2052357 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (pdd888167 .top) (exploit\_kit.rules) - 2052358 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (pdd888167 .top) (exploit\_kit.rules) - 2052404 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (fitnessscop .com) (exploit\_kit.rules) - 2052405 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (fitnessscop .com) (exploit\_kit.rules) - 2052447 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (thecookoutcaterer .com) (exploit\_kit.rules) - 2052448 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (firsho .com) (exploit\_kit.rules) - 2052449 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (geronimooficial .com) (exploit\_kit.rules) - 2052450 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (thecookoutcaterer .com) (exploit\_kit.rules) - 2052451 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (firsho .com) (exploit\_kit.rules) - 2052452 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (geronimooficial .com) (exploit\_kit.rules) - 2052453 - ET MALWARE SocGholish CnC Domain in DNS Lookup (\* .colo .oystergarden .net) (malware.rules) - 2052454 - ET MALWARE SocGholish CnC Domain in TLS SNI (\* .colo .oystergarden .net) (malware.rules) - 2052496 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (bandarsport .net) (exploit\_kit.rules) - 2052497 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (itemsdostawa .com) (exploit\_kit.rules) - 2052498 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (bandarsport .net) (exploit\_kit.rules) - 2052499 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (itemsdostawa .com) (exploit\_kit.rules) - 2052500 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (libidotechnexus .com) (exploit\_kit.rules) - 2052501 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (libidotechnexus .com) (exploit\_kit.rules) - 2052502 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (valentinedaycard .com) (exploit\_kit.rules) - 2052503 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (valentinedaycard .com) (exploit\_kit.rules) - 2052511 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (currentsilverprice .com) (exploit\_kit.rules) - 2052512 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (debtavailable .com) (exploit\_kit.rules) - 2052513 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (listwisconsin .com) (exploit\_kit.rules) - 2052514 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (teachabletutorials .com) (exploit\_kit.rules) - 2052515 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (voicelesson .org) (exploit\_kit.rules) - 2052516 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (waytowealth .org) (exploit\_kit.rules) - 2052517 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (currentsilverprice .com) (exploit\_kit.rules) - 2052518 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (debtavailable .com) (exploit\_kit.rules) - 2052519 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (listwisconsin .com) (exploit\_kit.rules) - 2052520 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (teachabletutorials .com) (exploit\_kit.rules) - 2052521 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (voicelesson .org) (exploit\_kit.rules) - 2052522 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (waytowealth .org) (exploit\_kit.rules) - 2052531 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (consultantinsurance .net) (exploit\_kit.rules) - 2052532 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (skylinehigh .com) (exploit\_kit.rules) - 2052533 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (y9f6z0q1w2 .xyz) (exploit\_kit.rules) - 2052534 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (consultantinsurance .net) (exploit\_kit.rules) - 2052535 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (skylinehigh .com) (exploit\_kit.rules) - 2052536 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (y9f6z0q1w2 .xyz) (exploit\_kit.rules) - 2852953 - ETPRO MALWARE Qbot Style Payload Request (malware.rules) - 2857301 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2857302 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) * * * ## Removed rules: - 2037082 - ET ACTIVEX Possible Follina Payload Delivery Page (activex.rules)