# Ruleset Update Summary - 2025/02/04 - v10852 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 4, 2025, 9:23pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-02-04-v10852/2417 "2025-02-04T21:23:12Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 4, 2025, 9:23pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-02-04-v10852/2417/1 "2025-02-04T21:23:12Z")
## Summary: 15 new OPEN, 22 new PRO (15 + 7) * * * ## Added rules: ### Open: - 2059874 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (alhocobser .digital) (malware.rules) - 2059875 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (alhocobser .digital in TLS SNI) (malware.rules) - 2059876 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (natureinspirged .top) (malware.rules) - 2059877 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (natureinspirged .top in TLS SNI) (malware.rules) - 2059878 - ET WEB\_SPECIFIC\_APPS QNAP Viostor server.cgi SPECIFIC\_SERVER Parameter Command Injection Attempt (CVE-2023-47565) (web\_specific\_apps.rules) - 2059879 - ET WEB\_SPECIFIC\_APPS HPE Insights Remote Support XML External Entity Injection (CVE-2024-53675) (web\_specific\_apps.rules) - 2059880 - ET WEB\_SPECIFIC\_APPS Ivanti Avalanche SmartDeviceServer XML External Entity Injection (CVE-2024-38653) (web\_specific\_apps.rules) - 2059881 - ET WEB\_SPECIFIC\_APPS FXC AE1021 Series Router ntp.general.hostname Authenticated Command Injection Attempt (CVE-2023-49897) (web\_specific\_apps.rules) - 2059882 - ET PHISHING Tycoon2FA Phishing Kit Style Evasion (phishing.rules) - 2059883 - ET MALWARE SocGholish CnC Domain in DNS Lookup (newsite .iapmd .org) (malware.rules) - 2059884 - ET MALWARE SocGholish CnC Domain in TLS SNI (newsite .iapmd .org) (malware.rules) - 2059885 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (aecint .com) (exploit\_kit.rules) - 2059886 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (aecint .com) (exploit\_kit.rules) - 2059887 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (aylingallery .shop) (exploit\_kit.rules) - 2059888 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (aylingallery .shop) (exploit\_kit.rules) ### Pro: - 2859891 - ETPRO PHISHING CoGUI Phish Landing Page 2025-02-04 (phishing.rules) - 2859892 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2859893 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2859894 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2859895 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules) - 2859896 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859897 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)