# Ruleset Update Summary - 2024/07/23 - v10651

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-23-v10651/1840>\
**Category:** Ruleset Updates\
**Created:** [July 23, 2024, 8:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-23-v10651/1840 "2024-07-23T20:38:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 23, 2024, 8:38pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-07-23-v10651/1840/1 "2024-07-23T20:38:00Z")

</div>

## Summary:

10 new OPEN, 27 new PRO (10 + 17)

Thanks @JAMESWT\_MHT

* * *

## Added rules:

### Open:

- 2054644 - ET MALWARE ZPHP CnC Domain in DNS Lookup (2n8rd3zz1 .top) (malware.rules)
- 2054645 - ET MALWARE ZPHP CnC Domain in TLS SNI (2n8rd3zz1 .top) (malware.rules)
- 2054646 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (coaching-the-boss .com) (exploit\_kit.rules)
- 2054647 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (knoxvillevideoproductions .com) (exploit\_kit.rules)
- 2054648 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (darchrif .com) (exploit\_kit.rules)
- 2054649 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (coaching-the-boss .com) (exploit\_kit.rules)
- 2054650 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (knoxvillevideoproductions .com) (exploit\_kit.rules)
- 2054651 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (darchrif .com) (exploit\_kit.rules)
- 2054652 - ET MALWARE Daolpu Stealer Data Exfiltration Attempt (malware.rules)
- 2054653 - ET MALWARE Lumma Stealer CnC Host Checkin (malware.rules)

### Pro:

- 2857641 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2857642 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2857643 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2857644 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2857645 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2857646 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2857647 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2857648 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2857649 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2857650 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2857651 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2857652 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2857653 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2857654 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2857655 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2857656 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2857657 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)