# Ruleset Update Summary - 2025/01/02 - v10822 **URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2025-01-02-v10822/2313 **Category:** Ruleset Updates **Created:** [January 2, 2025, 10:10pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-01-02-v10822/2313 "2025-01-02T22:10:05Z") **Posts on this page:** 1 **Page:** 1
### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot) #### Post date: [January 2, 2025, 10:10pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-01-02-v10822/2313/1 "2025-01-02T22:10:05Z")
## Summary: 11 new OPEN, 18 new PRO (11 + 7) * * * ## Added rules: ### Open: - 2058717 - ET MALWARE Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected (malware.rules) - 2058718 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (mirugby .com) (exploit\_kit.rules) - 2058719 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (mirugby .com) (exploit\_kit.rules) - 2058720 - ET MALWARE Win32/SocGholish CnC Domain in DNS Lookup (\* .slot .buyaiphoneonline .com) (malware.rules) - 2058721 - ET MALWARE Win32/SocGholish CnC Domain in TLS SNI (\* .slot .buyaiphoneonline .com) (malware.rules) - 2058722 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abberanteusz .click) (malware.rules) - 2058723 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (abberanteusz .click in TLS SNI) (malware.rules) - 2058724 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scirroscus .click) (malware.rules) - 2058725 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (scirroscus .click in TLS SNI) (malware.rules) - 2058726 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (storyspaddr .click) (malware.rules) - 2058727 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (storyspaddr .click in TLS SNI) (malware.rules) ### Pro: - 2859485 - ETPRO EXPLOIT\_KIT Malicious ClickFix Scam Redirect Path (exploit\_kit.rules) - 2859486 - ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound (malware.rules) - 2859487 - ETPRO MALWARE Observed ClickFix Powershell Delivery Page Inbound (malware.rules) - 2859488 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859489 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859490 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859491 - ETPRO MALWARE HTTP Request to ClickFix Delivery Domain (GET) (malware.rules) * * * ## Modified inactive rules: - 2037041 - ET EXPLOIT Apache Tommcat/JBoss RCE Inbound (CVE-2013-4810) (exploit.rules) * * * ## Disabled and modified rules: - 2859379 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859390 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859391 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859392 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)