# Ruleset Update Summary - 2024/11/12 - v10740

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-12-v10740/2133>\
**Category:** Ruleset Updates\
**Created:** [November 12, 2024, 10:04pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-12-v10740/2133 "2024-11-12T22:04:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 12, 2024, 10:04pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-11-12-v10740/2133/1 "2024-11-12T22:04:22Z")

</div>

## Summary:

28 new OPEN, 37 new PRO (28 + 9)

* * *

## Added rules:

### Open:

- 2057382 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (300snails .sbs) (malware.rules)
- 2057383 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (300snails .sbs in TLS SNI) (malware.rules)
- 2057384 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (3xc1aimbl0w .sbs) (malware.rules)
- 2057385 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (3xc1aimbl0w .sbs in TLS SNI) (malware.rules)
- 2057386 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (automatic-meaty .sbs) (malware.rules)
- 2057387 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (automatic-meaty .sbs in TLS SNI) (malware.rules)
- 2057388 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bored-light .sbs) (malware.rules)
- 2057389 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bored-light .sbs in TLS SNI) (malware.rules)
- 2057390 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crib-endanger .sbs) (malware.rules)
- 2057391 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (crib-endanger .sbs in TLS SNI) (malware.rules)
- 2057392 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (faintbl0w .sbs) (malware.rules)
- 2057393 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (faintbl0w .sbs in TLS SNI) (malware.rules)
- 2057394 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fleez-inc .sbs) (malware.rules)
- 2057395 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fleez-inc .sbs in TLS SNI) (malware.rules)
- 2057396 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (frogmen-smell .sbs) (malware.rules)
- 2057397 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (frogmen-smell .sbs in TLS SNI) (malware.rules)
- 2057398 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pull-trucker .sbs) (malware.rules)
- 2057399 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pull-trucker .sbs in TLS SNI) (malware.rules)
- 2057400 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (qualifiresui .cyou) (malware.rules)
- 2057401 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (qualifiresui .cyou in TLS SNI) (malware.rules)
- 2057402 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thicktoys .sbs) (malware.rules)
- 2057403 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (thicktoys .sbs in TLS SNI) (malware.rules)
- 2057404 - ET EXPLOIT\_KIT CC Skimmer Domain in DNS Lookup (advertls .shop) (exploit\_kit.rules)
- 2057405 - ET EXPLOIT\_KIT CC Skimmer Domain in TLS Lookup (advertls .shop) (exploit\_kit.rules)
- 2057406 - ET EXPLOIT\_KIT VexTrio Domain in DNS Lookup (omenkid .top) (exploit\_kit.rules)
- 2057407 - ET EXPLOIT\_KIT VexTrio Domain in TLS SNI (omenkid .top) (exploit\_kit.rules)
- 2057408 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (fencingfriends .com) (exploit\_kit.rules)
- 2057409 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (fencingfriends .com) (exploit\_kit.rules)

### Pro:

- 2859007 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2859008 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2859009 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules)
- 2859010 - ETPRO MALWARE Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules)
- 2859011 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2859012 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules)
- 2859013 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2859014 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules)
- 2859015 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)