# Ruleset Update Summary - 2024/10/25 - v10728

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-25-v10728/2076>\
**Category:** Ruleset Updates\
**Created:** [October 25, 2024, 9:11pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-25-v10728/2076 "2024-10-25T21:11:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [October 25, 2024, 9:11pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-25-v10728/2076/1 "2024-10-25T21:11:38Z")

</div>

## Summary:

21 new OPEN, 35 new PRO (21 + 14)

Thanks Kevin, Ross

* * *

## Added rules:

### Open:

- 2057043 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (arreggshow .cfd) (malware.rules)
- 2057044 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (arreggshow .cfd in TLS SNI) (malware.rules)
- 2057045 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wheatari .cyou) (malware.rules)
- 2057046 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (wheatari .cyou in TLS SNI) (malware.rules)
- 2057047 - ET INFO DYNAMIC\_DNS Query to a \* .elephantass .com Domain (info.rules)
- 2057048 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .elephantass .com Domain (info.rules)
- 2057049 - ET INFO DYNAMIC\_DNS Query to a \* .stevekoch .ca Domain (info.rules)
- 2057050 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .stevekoch .ca Domain (info.rules)
- 2057051 - ET INFO DYNAMIC\_DNS Query to a \* .ens .org Domain (info.rules)
- 2057052 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .ens .org Domain (info.rules)
- 2057053 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (arreggshow .cfd) (malware.rules)
- 2057054 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (arreggshow .cfd in TLS SNI) (malware.rules)
- 2057055 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wheatari .cyou) (malware.rules)
- 2057056 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (wheatari .cyou in TLS SNI) (malware.rules)
- 2057057 - ET MALWARE ZharkBOT CnC Activity (GET) M1 (malware.rules)
- 2057058 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (arubapalmrealtor .com) (exploit\_kit.rules)
- 2057059 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (arubapalmrealtor .com) (exploit\_kit.rules)
- 2057060 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (cosdfdfrefdch .best) (exploit\_kit.rules)
- 2057061 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (cosdfdfrefdch .best) (exploit\_kit.rules)
- 2057062 - ET MALWARE ZharkBOT CnC Activity (GET) M2 (malware.rules)
- 2057063 - ET MALWARE Mints.Loader CnC Activity (GET) (malware.rules)

### Pro:

- 2858797 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
- 2858798 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2858799 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2858800 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2858801 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2858802 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
- 2858803 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2858804 - ETPRO MALWARE Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
- 2858805 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2858806 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
- 2858807 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2858808 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2858809 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
- 2858810 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)

* * *

## Disabled and modified rules:

- 2056856 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (explorationmsn .store) (malware.rules)
- 2056858 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (explorationmsn .store in TLS SNI) (malware.rules)