# Ruleset Update Summary - 2024/10/24 - v10727 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 24, 2024, 9:22pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-24-v10727/2074 "2024-10-24T21:22:23Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 24, 2024, 9:22pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-24-v10727/2074/1 "2024-10-24T21:22:23Z")
## Summary: 11 new OPEN, 15 new PRO (11 + 4) * * * ## Added rules: ### Open: - 2057032 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (topwebsites3d .com) (exploit\_kit.rules) - 2057033 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (broworker10s .com) (exploit\_kit.rules) - 2057034 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (readytocheckline .com) (exploit\_kit.rules) - 2057035 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (topwebsites3d .com) (exploit\_kit.rules) - 2057036 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (broworker10s .com) (exploit\_kit.rules) - 2057037 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (readytocheckline .com) (exploit\_kit.rules) - 2057038 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (adullamglobal .com) (exploit\_kit.rules) - 2057039 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (adullamglobal .com) (exploit\_kit.rules) - 2057040 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (cuansurga .cam) (exploit\_kit.rules) - 2057041 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (cuansurga .cam) (exploit\_kit.rules) - 2057042 - ET HUNTING Fortinet FortiManager API DVM Add Device (hunting.rules) ### Pro: - 2858295 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) (malware.rules) - 2858794 - ETPRO ATTACK\_RESPONSE ReverseLoader Base64 Payload Inbound After HTTP Request With Minimal Headers (attack\_response.rules) - 2858795 - ETPRO MALWARE ReverseLoader Payload Request (GET) M2 (malware.rules) - 2858796 - ETPRO MALWARE ReverseLoader Payload Request (GET) M1 (malware.rules) * * * ## Enabled and modified rules: - 2054794 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (recordsbluemountain .com) (exploit\_kit.rules) - 2054795 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (recordsbluemountain .com) (exploit\_kit.rules) * * * ## Disabled and modified rules: - 2050556 - ET MALWARE SocGholish Domain in DNS Lookup (miner .eastestsite .com) (malware.rules) - 2050557 - ET MALWARE SocGholish Domain in TLS SNI (miner .eastestsite .com) (malware.rules) - 2053784 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (ryruhuu3 .xyz) (exploit\_kit.rules) - 2053785 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (ryruhuu3 .xyz) (exploit\_kit.rules) - 2055341 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (carnivalsale .com) (exploit\_kit.rules) - 2055342 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (boylegmfg .com) (exploit\_kit.rules) - 2055343 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (localdominationsystems .com) (exploit\_kit.rules) - 2055344 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (carnivalsale .com) (exploit\_kit.rules) - 2055345 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (boylegmfg .com) (exploit\_kit.rules) - 2055346 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (localdominationsystems .com) (exploit\_kit.rules) - 2055357 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (cafeespeciales .com) (exploit\_kit.rules) - 2055360 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (cafeespeciales .com) (exploit\_kit.rules) - 2055371 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (iprotosample .com) (exploit\_kit.rules) - 2055372 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (iprotosample .com) (exploit\_kit.rules) - 2055383 - ET EXPLOIT\_KIT ClearFake Domain in DNS Lookup (expertcloud .xyz) (exploit\_kit.rules) - 2055384 - ET EXPLOIT\_KIT ClearFake Domain in TLS SNI (expertcloud .xyz) (exploit\_kit.rules) - 2055396 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (queimaxofc .com) (exploit\_kit.rules) - 2055398 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (queimaxofc .com) (exploit\_kit.rules) - 2055405 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (codcraft .shop) (exploit\_kit.rules) - 2055406 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (codemingle .shop) (exploit\_kit.rules) - 2055407 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (datawiz .shop) (exploit\_kit.rules) - 2055408 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (deslgnpro .shop) (exploit\_kit.rules) - 2055409 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (happywave .shop) (exploit\_kit.rules) - 2055410 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (luckipath .shop) (exploit\_kit.rules) - 2055411 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (pixelsmith .shop) (exploit\_kit.rules) - 2055412 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (salesguru .online) (exploit\_kit.rules) - 2055413 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (statlstic .shop) (exploit\_kit.rules) - 2055414 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (statmaster .shop) (exploit\_kit.rules) - 2055415 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (trendset .website) (exploit\_kit.rules) - 2055416 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (vodog .shop) (exploit\_kit.rules) - 2055417 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (artvislon .shop) (exploit\_kit.rules) - 2055418 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (statistall .com) (exploit\_kit.rules) - 2055419 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in DNS Lookup (analytlx .shop) (exploit\_kit.rules) - 2055420 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (codcraft .shop) (exploit\_kit.rules) - 2055421 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (codemingle .shop) (exploit\_kit.rules) - 2055422 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (datawiz .shop) (exploit\_kit.rules) - 2055423 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (deslgnpro .shop) (exploit\_kit.rules) - 2055424 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (happywave .shop) (exploit\_kit.rules) - 2055425 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (luckipath .shop) (exploit\_kit.rules) - 2055426 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (pixelsmith .shop) (exploit\_kit.rules) - 2055427 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (salesguru .online) (exploit\_kit.rules) - 2055428 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (statlstic .shop) (exploit\_kit.rules) - 2055429 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (statmaster .shop) (exploit\_kit.rules) - 2055430 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (trendset .website) (exploit\_kit.rules) - 2055431 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (vodog .shop) (exploit\_kit.rules) - 2055432 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (artvislon .shop) (exploit\_kit.rules) - 2055433 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (statistall .com) (exploit\_kit.rules) - 2055434 - ET EXPLOIT\_KIT Credit Card Skimmer Domain in TLS SNI (analytlx .shop) (exploit\_kit.rules) - 2055435 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (elmipardaz .com) (exploit\_kit.rules) - 2055436 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (elmipardaz .com) (exploit\_kit.rules) - 2055437 - ET EXPLOIT\_KIT ClickFix Domain in DNS Lookup (skibidirizz .lol) (exploit\_kit.rules) - 2055438 - ET EXPLOIT\_KIT ClickFix Domain in TLS SNI (skibidirizz .lol) (exploit\_kit.rules) - 2857688 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2857690 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2858640 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2858641 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) * * * ## Removed rules: - 2858295 - ETPRO HUNTING Reverse Base64 Encoded EXE Content-Type Mismatch (text/plain) (hunting.rules)