# Ruleset Update Summary - 2025/01/15 - v10838 **URL:** \ **Category:** Ruleset Updates\ **Created:** [January 15, 2025, 9:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-01-15-v10838/2359 "2025-01-15T21:51:14Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [January 15, 2025, 9:51pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-01-15-v10838/2359/1 "2025-01-15T21:51:14Z")
## Summary: 27 new OPEN, 33 new PRO (27 + 6) Thanks @gmcirt * * * ## Added rules: ### Open: - 2059254 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (efffe .top) (exploit\_kit.rules) - 2059255 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (rentenfonds .top) (exploit\_kit.rules) - 2059256 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (efffe .top) (exploit\_kit.rules) - 2059257 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (rentenfonds .top) (exploit\_kit.rules) - 2059258 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (comtekinc .com) (exploit\_kit.rules) - 2059259 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (comtekinc .com) (exploit\_kit.rules) - 2059260 - ET MALWARE Obfuscated Clickfix Javascript Payload Inbound (malware.rules) - 2059261 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (burnressert .shop) (malware.rules) - 2059262 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (burnressert .shop in TLS SNI) (malware.rules) - 2059263 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (buynostopliik .shop) (malware.rules) - 2059264 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (buynostopliik .shop in TLS SNI) (malware.rules) - 2059265 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cabbagebettys .shop) (malware.rules) - 2059266 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cabbagebettys .shop in TLS SNI) (malware.rules) - 2059267 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cultureddirtys .click) (malware.rules) - 2059268 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cultureddirtys .click in TLS SNI) (malware.rules) - 2059269 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (getflashygai .shop) (malware.rules) - 2059270 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (getflashygai .shop in TLS SNI) (malware.rules) - 2059271 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (latyoutw .cyou) (malware.rules) - 2059272 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (latyoutw .cyou in TLS SNI) (malware.rules) - 2059273 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mittensootsjz .cyou) (malware.rules) - 2059274 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mittensootsjz .cyou in TLS SNI) (malware.rules) - 2059275 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (plodnittpw .lat) (malware.rules) - 2059276 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (plodnittpw .lat in TLS SNI) (malware.rules) - 2059277 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sobrattyeu .bond) (malware.rules) - 2059278 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sobrattyeu .bond in TLS SNI) (malware.rules) - 2059279 - ET INFO URL Shortener Domain in DNS Lookup (url .rw) (info.rules) - 2059280 - ET INFO Observed URL Shortener Domain (url .rw in TLS SNI) (info.rules) ### Pro: - 2859606 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859607 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859608 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859609 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2859610 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2859611 - ETPRO INFO Fake 404 Landing Page from Anti-DDoS Lua Script Challenge (info.rules)