# Ruleset Update Summary - 2024/11/08 - v10738

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-08-v10738/2122>\
**Category:** Ruleset Updates\
**Created:** [November 8, 2024, 9:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-08-v10738/2122 "2024-11-08T21:51:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 8, 2024, 9:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-08-v10738/2122/1 "2024-11-08T21:51:43Z")

</div>

## Summary:

14 new OPEN, 31 new PRO (14 + 17)

* * *

## Added rules:

### Open:

- 2057320 - ET INFO DYNAMIC\_DNS Query to a \*.unitgrapigs .com domain (info.rules)
- 2057321 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.unitgrapigs .com domain (info.rules)
- 2057322 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (boltycoupeln .cyou) (malware.rules)
- 2057323 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (boltycoupeln .cyou in TLS SNI) (malware.rules)
- 2057324 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (boys .terrifyenyb .icu) (malware.rules)
- 2057325 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (boys .terrifyenyb .icu in TLS SNI) (malware.rules)
- 2057326 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (travis .terrifyenyb .icu) (malware.rules)
- 2057327 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (travis .terrifyenyb .icu in TLS SNI) (malware.rules)
- 2057328 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (uniquedpieco .site) (malware.rules)
- 2057329 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (uniquedpieco .site in TLS SNI) (malware.rules)
- 2057330 - ET WEB\_SPECIFIC\_APPS D-Link NAS OS Command Injection in cgi\_user\_add Function (CVE-2024-10914) (web\_specific\_apps.rules)
- 2057331 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (junocis .com) (exploit\_kit.rules)
- 2057332 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (junocis .com) (exploit\_kit.rules)
- 2057333 - ET PHISHING MAMBA Credential Phish Landing Page 2024-11-08 (phishing.rules)

### Pro:

- 2858914 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2858915 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2858916 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2858917 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2858918 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2858919 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2858920 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2858921 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2858922 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2858923 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2858924 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2858925 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2858926 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2858927 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2858928 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2858929 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2858930 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)