# Ruleset Update Summary - 2024/07/17 - v10647

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-17-v10647/1826>\
**Category:** Ruleset Updates\
**Created:** [July 17, 2024, 9:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-17-v10647/1826 "2024-07-17T21:34:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 17, 2024, 9:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-17-v10647/1826/1 "2024-07-17T21:34:28Z")

</div>

## Summary:

26 new OPEN, 29 new PRO (26 + 3)

* * *

## Added rules:

### Open:

- 2054515 - ET EXPLOIT\_KIT Parrot TDS Domain in DNS Lookup (jswebcloud .com) (exploit\_kit.rules)
- 2054516 - ET EXPLOIT\_KIT Parrot TDS Domain in TLS SNI (jswebcloud .com) (exploit\_kit.rules)
- 2054517 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (wilderglamour .com) (exploit\_kit.rules)
- 2054518 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (oakgrovetraining .com) (exploit\_kit.rules)
- 2054519 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (shawns-landscaping .com) (exploit\_kit.rules)
- 2054520 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (wilderglamour .com) (exploit\_kit.rules)
- 2054521 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (oakgrovetraining .com) (exploit\_kit.rules)
- 2054522 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (shawns-landscaping .com) (exploit\_kit.rules)
- 2054523 - ET MALWARE DNS Query to Payload Downloader Domain (italy700 .blogspot .com) (malware.rules)
- 2054524 - ET MALWARE DNS Query to Payload Downloader Domain (800french .blogspot .com) (malware.rules)
- 2054525 - ET MALWARE DNS Query to Payload Downloader Domain (800germany .blogspot .com) (malware.rules)
- 2054526 - ET MALWARE DNS Query to Payload Downloader Domain (900cap .blogspot .com) (malware.rules)
- 2054527 - ET MALWARE DNS Query to Payload Downloader Domain (others500 .blogspot .com) (malware.rules)
- 2054528 - ET MALWARE DNS Query to Payload Downloader Domain (backpupcpa .blogspot .com) (malware.rules)
- 2054529 - ET MALWARE Observed Payload Downloader Domain (italy700 .blogspot .com in TLS SNI) (malware.rules)
- 2054530 - ET MALWARE Observed Payload Downloader Domain (800french .blogspot .com in TLS SNI) (malware.rules)
- 2054531 - ET MALWARE Observed Payload Downloader Domain (800germany .blogspot .com in TLS SNI) (malware.rules)
- 2054532 - ET MALWARE Observed Payload Downloader Domain (900cap .blogspot .com in TLS SNI) (malware.rules)
- 2054533 - ET MALWARE Observed Payload Downloader Domain (others500 .blogspot .com in TLS SNI) (malware.rules)
- 2054534 - ET MALWARE Observed Payload Downloader Domain (backpupcpa .blogspot .com in TLS SNI) (malware.rules)
- 2054535 - ET MALWARE DNS Query to Payload Downloader Domain (pupuputu .blogspot .com) (malware.rules)
- 2054536 - ET MALWARE DNS Query to Payload Downloader Domain (capclean2024may .blogspot .com) (malware.rules)
- 2054537 - ET MALWARE Observed Payload Downloader Domain (pupuputu .blogspot .com in TLS SNI) (malware.rules)
- 2054538 - ET MALWARE Observed Payload Downloader Domain (capclean2024may .blogspot .com in TLS SNI) (malware.rules)
- 2054539 - ET INFO Commonly Actor Abused Online Service Domain (usrfiles .com) (info.rules)
- 2054540 - ET INFO Observed Commonly Actor Abused Online Service Domain (usrfiles .com in TLS SNI) (info.rules)

### Pro:

- 2857631 - ETPRO MALWARE Generic VBS Script Executing PowerShell Command Inbound (malware.rules)
- 2857634 - ETPRO MALWARE Malicious NetSupport Rat CnC Checkin (malware.rules)
- 2857635 - ETPRO MALWARE Malicious NetSupport Rat CnC Checkin (malware.rules)

* * *

## Enabled and modified rules:

- 2048566 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (climedballon .org) (exploit\_kit.rules)
- 2048567 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (climedballon .org) (exploit\_kit.rules)
- 2049714 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (catsndogz .org) (exploit\_kit.rules)
- 2049715 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (catsndogz .org) (exploit\_kit.rules)
- 2049720 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (circuspride .org) (exploit\_kit.rules)
- 2049721 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (circuspride .org) (exploit\_kit.rules)
- 2049822 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in DNS Lookup (biggerfun .org) (exploit\_kit.rules)
- 2049825 - ET EXPLOIT\_KIT TA569 Keitaro TDS Domain in TLS SNI (biggerfun .org) (exploit\_kit.rules)
- 2050452 - ET EXPLOIT\_KIT Parrot TDS Domain in DNS Lookup (ping .cachespace .net) (exploit\_kit.rules)
- 2050461 - ET EXPLOIT\_KIT Parrot TDS Domain in TLS SNI (ping .cachespace .net) (exploit\_kit.rules)