# Ruleset Update Summary - 2024/12/24 - v10816 **URL:** \ **Category:** Ruleset Updates\ **Created:** [December 24, 2024, 11:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-12-24-v10816/2293 "2024-12-24T23:25:38Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [December 24, 2024, 11:25pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2024-12-24-v10816/2293/1 "2024-12-24T23:25:38Z")
## Summary: 20 new OPEN, 22 new PRO (20 + 2) * * * ## Added rules: ### Open: - 2058516 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (we-careu .xyz) (exploit\_kit.rules) - 2058517 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (haimasher .xyz) (exploit\_kit.rules) - 2058518 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (suclub .xyz) (exploit\_kit.rules) - 2058519 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (we-careu .xyz) (exploit\_kit.rules) - 2058520 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (haimasher .xyz) (exploit\_kit.rules) - 2058521 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (suclub .xyz) (exploit\_kit.rules) - 2058522 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (dhusch .com) (exploit\_kit.rules) - 2058523 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (dhusch .com) (exploit\_kit.rules) - 2058524 - ET INFO DYNAMIC\_DNS Query to a \*.karsten .com .mx domain (info.rules) - 2058525 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.karsten .com .mx domain (info.rules) - 2058526 - ET INFO DYNAMIC\_DNS Query to a \*.record-point .com .au domain (info.rules) - 2058527 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.record-point .com .au domain (info.rules) - 2058528 - ET INFO DYNAMIC\_DNS Query to a \*.hitam .id domain (info.rules) - 2058529 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.hitam .id domain (info.rules) - 2058530 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (erectystickj .click) (malware.rules) - 2058531 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (erectystickj .click in TLS SNI) (malware.rules) - 2058532 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (marrieddinn .click) (malware.rules) - 2058533 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (marrieddinn .click in TLS SNI) (malware.rules) - 2058534 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (volcanohushe .click) (malware.rules) - 2058535 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (volcanohushe .click in TLS SNI) (malware.rules) ### Pro: - 2859428 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859429 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)