# Ruleset Update Summary - 2024/10/28 - v10729 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 28, 2024, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-28-v10729/2083 "2024-10-28T20:41:29Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 28, 2024, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-10-28-v10729/2083/1 "2024-10-28T20:41:29Z")
## Summary: 55 new OPEN, 56 new PRO (55 + 1) Thanks @g0njxa * * * ## Added rules: ### Open: - 2057064 - ET WEB\_SPECIFIC\_APPS PFsense Stored Cross-Site Scripting (CVE-2024-46538) (web\_specific\_apps.rules) - 2057065 - ET MALWARE SocGholish CnC Domain in DNS (\* .range .cccinvolve .org) (malware.rules) - 2057066 - ET MALWARE SocGholish CnC Domain in TLS SNI (\* .range .cccinvolve .org) (malware.rules) - 2057067 - ET INFO DYNAMIC\_DNS Query to a \* .vhutambo .co .za Domain (info.rules) - 2057068 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .vhutambo .co .za Domain (info.rules) - 2057069 - ET INFO DYNAMIC\_DNS Query to a \* .gewamed .de Domain (info.rules) - 2057070 - ET INFO DYNAMIC\_DNS HTTP Request to a \* .gewamed .de Domain (info.rules) - 2057071 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (authorisev .site) (malware.rules) - 2057072 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (authorisev .site in TLS SNI) (malware.rules) - 2057073 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (carbonhari .cyou) (malware.rules) - 2057074 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (carbonhari .cyou in TLS SNI) (malware.rules) - 2057075 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (colldycatle .cyou) (malware.rules) - 2057076 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (colldycatle .cyou in TLS SNI) (malware.rules) - 2057077 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (contemteny .site) (malware.rules) - 2057078 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (contemteny .site in TLS SNI) (malware.rules) - 2057079 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dilemmadu .site) (malware.rules) - 2057080 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (dilemmadu .site in TLS SNI) (malware.rules) - 2057081 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fashionablei .sbs) (malware.rules) - 2057082 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fashionablei .sbs in TLS SNI) (malware.rules) - 2057083 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (faulteyotk .site) (malware.rules) - 2057084 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (faulteyotk .site in TLS SNI) (malware.rules) - 2057085 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (goalyfeastz .site) (malware.rules) - 2057086 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (goalyfeastz .site in TLS SNI) (malware.rules) - 2057087 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (messejawu .store) (malware.rules) - 2057088 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (messejawu .store in TLS SNI) (malware.rules) - 2057089 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (opposezmny .site) (malware.rules) - 2057090 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (opposezmny .site in TLS SNI) (malware.rules) - 2057091 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prinyveri .cfd) (malware.rules) - 2057092 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (prinyveri .cfd in TLS SNI) (malware.rules) - 2057093 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (seallysl .site) (malware.rules) - 2057094 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (seallysl .site in TLS SNI) (malware.rules) - 2057095 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (servicedny .site) (malware.rules) - 2057096 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (servicedny .site in TLS SNI) (malware.rules) - 2057097 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thighpecr .cyou) (malware.rules) - 2057098 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (thighpecr .cyou in TLS SNI) (malware.rules) - 2057099 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (transparenteunlawfullyp .site) (malware.rules) - 2057100 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (transparenteunlawfullyp .site in TLS SNI) (malware.rules) - 2057101 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) (malware.rules) - 2057102 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (scriptyprefej .store in TLS SNI) (malware.rules) - 2057103 - ET MALWARE Win32/Ailurophile Stealer CnC Domain in DNS Lookup (manestvli .shop) (malware.rules) - 2057104 - ET MALWARE Observed Win32/Ailurophile Stealer Domain (manestvli .shop) in TLS SNI (malware.rules) - 2057105 - ET ATTACK\_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese) (attack\_response.rules) - 2057106 - ET ATTACK\_RESPONSE Observed ClickFix Powershell Delivery Page Inbound (attack\_response.rules) - 2057107 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (perfectlinestarter .com) (exploit\_kit.rules) - 2057108 - ET EXPLOIT\_KIT Balada Domain in DNS Lookup (linetoslice .com) (exploit\_kit.rules) - 2057109 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (perfectlinestarter .com) (exploit\_kit.rules) - 2057110 - ET EXPLOIT\_KIT Balada Domain in TLS SNI (linetoslice .com) (exploit\_kit.rules) - 2057111 - ET EXPLOIT\_KIT TA569 Middleware Domain in DNS Lookup (promiseresolverdev .com) (exploit\_kit.rules) - 2057112 - ET EXPLOIT\_KIT TA569 Middleware Domain in TLS SNI (promiseresolverdev .com) (exploit\_kit.rules) - 2057113 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (prepare2swim .com) (exploit\_kit.rules) - 2057114 - ET MALWARE Observed DNS Query to ClickFix Domain (bigops .s3 .us-east-2 .amazonaws .com) (malware.rules) - 2057115 - ET MALWARE Observed DNS Query to ClickFix Domain (youcansay .s3 .us-east-2 .amazonaws .com) (malware.rules) - 2057116 - ET MALWARE Observed ClickFix Domain (bigops .s3 .us-east-2 .amazonaws .com in TLS SNI) (malware.rules) - 2057117 - ET MALWARE Observed ClickFix Domain (youcansay .s3 .us-east-2 .amazonaws .com in TLS SNI) (malware.rules) - 2057118 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (prepare2swim .com) (exploit\_kit.rules) ### Pro: - 2858827 - ETPRO HUNTING V8 JavaScript Engine JIT Forcing Observed - Investigate Possible Exploitation M4 (hunting.rules)