# Ruleset Update Summary - 2025/02/07 - v10855 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 7, 2025, 10:09pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-02-07-v10855/2423 "2025-02-07T22:09:14Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 7, 2025, 10:09pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-02-07-v10855/2423/1 "2025-02-07T22:09:14Z")
## Summary: 34 new OPEN, 38 new PRO (34 + 4) Thanks @Fortinet * * * ## Added rules: ### Open: - 2059945 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (jakker-udsalg .top) (exploit\_kit.rules) - 2059946 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (websitedirectory .top) (exploit\_kit.rules) - 2059947 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (pilulespascher .top) (exploit\_kit.rules) - 2059948 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (jakker-udsalg .top) (exploit\_kit.rules) - 2059949 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (websitedirectory .top) (exploit\_kit.rules) - 2059950 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (pilulespascher .top) (exploit\_kit.rules) - 2059951 - ET MALWARE SocGholish CnC Domain in DNS Lookup (hub .unlimitedcashflowevent .com) (malware.rules) - 2059952 - ET MALWARE SocGholish CnC Domain in TLS SNI (hub .unlimitedcashflowevent .com) (malware.rules) - 2059953 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (telback .com) (exploit\_kit.rules) - 2059954 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (telback .com) (exploit\_kit.rules) - 2059955 - ET ADWARE\_PUP Onestart AI Host Profile Checkin (POST) (adware\_pup.rules) - 2059956 - ET ADWARE\_PUP Onestart AI Program Version Checkin (POST) (adware\_pup.rules) - 2059957 - ET MALWARE Winos4.0 Framework CnC Checkin (x32.) (malware.rules) - 2059958 - ET INFO DYNAMIC\_DNS Query to a \*.mounthoodlodges .com domain (info.rules) - 2059959 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.mounthoodlodges .com domain (info.rules) - 2059960 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (glibvisitiru .click) (malware.rules) - 2059961 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (glibvisitiru .click in TLS SNI) (malware.rules) - 2059962 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (muscleinitai .biz) (malware.rules) - 2059963 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (muscleinitai .biz in TLS SNI) (malware.rules) - 2059964 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (permussiduebuz .shop) (malware.rules) - 2059965 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (permussiduebuz .shop in TLS SNI) (malware.rules) - 2059966 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (radiantqwuest .top) (malware.rules) - 2059967 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (radiantqwuest .top in TLS SNI) (malware.rules) - 2059968 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (warmwhearts .cloud) (malware.rules) - 2059969 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (warmwhearts .cloud in TLS SNI) (malware.rules) - 2059970 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (weardawwerz .shop) (malware.rules) - 2059971 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (weardawwerz .shop in TLS SNI) (malware.rules) - 2059972 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zsilvermoonbeam .hair) (malware.rules) - 2059973 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (zsilvermoonbeam .hair in TLS SNI) (malware.rules) - 2059974 - ET MALWARE Winos4.0 Framework Fake BMP Download Containing XOR encoded .dll (malware.rules) - 2059975 - ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response (malware.rules) - 2059976 - ET MALWARE Winos4.0 Framework CnC Domain in DNS Lookup (ad59t82g .com) (malware.rules) - 2059977 - ET MALWARE Observed Winos4.0 Framework CnC Domain (ad59t82g .com in TLS SNI) (malware.rules) - 2059978 - ET INFO Lovable AI Generated Landing Page 2025-02-07 (info.rules) ### Pro: - 2860191 - ETPRO PHISHING TA453 Phishing CnC Activity (POST) (phishing.rules) - 2860192 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2860193 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2860194 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) * * * ## Disabled and modified rules: - 2058121 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (tasteofgoodness .info) (exploit\_kit.rules) - 2058122 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (casibom .cyou) (exploit\_kit.rules) - 2058123 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (dcaa .info) (exploit\_kit.rules) - 2058125 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (tasteofgoodness .info) (exploit\_kit.rules) - 2058126 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (casibom .cyou) (exploit\_kit.rules) - 2058127 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (dcaa .info) (exploit\_kit.rules) - 2058128 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (coeshor .com) (exploit\_kit.rules) - 2058129 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (coeshor .com) (exploit\_kit.rules) - 2058149 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (iognews .com) (exploit\_kit.rules) - 2058150 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (habfan .com) (exploit\_kit.rules) - 2058151 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (iognews .com) (exploit\_kit.rules) - 2058152 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (habfan .com) (exploit\_kit.rules) - 2058153 - ET MALWARE SocGholish CnC Domain in DNS Lookup (\* .material .amstillroofing .com) (malware.rules) - 2058155 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (jitcom .info) (exploit\_kit.rules) - 2058156 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (jitcom .info) (exploit\_kit.rules) - 2059358 - ET MALWARE Win32/SocGholish CnC Domain in DNS Lookup (\* .trial .buyintercomsonline .com) (malware.rules) - 2059359 - ET MALWARE Win32/SocGholish CnC Domain in TLS SNI (\* .trial .buyintercomsonline .com) (malware.rules) - 2059377 - ET MALWARE Win32/SocGholish CnC Domain in DNS Lookup (\* .crm .bestintownpro .com) (malware.rules) - 2059378 - ET MALWARE Win32/SocGholish CnC Domain in TLS SNI (\* .crm .bestintownpro .com) (malware.rules) - 2059445 - ET MALWARE Win32/SocGholish CnC Domain in DNS Lookup (\* .app .andredenault .com) (malware.rules) - 2059446 - ET MALWARE Win32/SocGholish CnC Domain in TLS SNI (\* .app .andredenault .com) (malware.rules) - 2059609 - ET MALWARE SocGholish CnC Domain in DNS Lookup (customer .aaddigitalstrategies .com) (malware.rules) - 2059610 - ET MALWARE SocGholish CnC Domain in TLS SNI (customer .aaddigitalstrategies .com) (malware.rules) - 2859736 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859737 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859738 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859739 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859740 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859741 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859742 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859757 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859758 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859759 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859760 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859777 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859787 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859788 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859789 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules) - 2859790 - ETPRO MALWARE TA582 Domain in DNS Lookup (malware.rules)