# Ruleset Update Summary - 2025/03/18 - v10883

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-18-v10883/2535>\
**Category:** Ruleset Updates\
**Created:** [March 18, 2025, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-18-v10883/2535 "2025-03-18T20:41:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [March 18, 2025, 8:41pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-18-v10883/2535/1 "2025-03-18T20:41:50Z")

</div>

## Summary:

14 new OPEN, 24 new PRO (14 + 10)

* * *

## Added rules:

### Open:

- 2060943 - ET PHISHING Github Credential Phish Domain in DNS Lookup (.\* github\* .onrender .com) (phishing.rules)
- 2060944 - ET PHISHING Observed Github Credential Phish Domain (.\* github\* .onrender .com in TLS SNI) (phishing.rules)
- 2060945 - ET WEB\_SPECIFIC\_APPS Wazuh Server Serialized Unhandled Exception Payload (CVE-2025-24016) (web\_specific\_apps.rules)
- 2060946 - ET INFO DYNAMIC\_DNS Query to a \*.switchestudio .com domain (info.rules)
- 2060947 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.switchestudio .com domain (info.rules)
- 2060948 - ET MALWARE Win32/TA569 Gholoader Domain in DNS Lookup (static .twalls5280 .com) (malware.rules)
- 2060949 - ET MALWARE Win32/TA569 Gholoader Domain in TLS SNI (static .twalls5280 .com) (malware.rules)
- 2060950 - ET MALWARE Unknown Stealer Victim Profile Exfiltration (POST) (malware.rules)
- 2060951 - ET MALWARE Unknown Stealer Victim Desktop Screenshot Exfiltration (POST) (malware.rules)
- 2060952 - ET INFO Zoho Social URL Shortener Service CnC Domain in DNS Lookup (zurl .co) (info.rules)
- 2060953 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (kimjohan .com) (exploit\_kit.rules)
- 2060954 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (kimjohan .com) (exploit\_kit.rules)
- 2060955 - ET EXPLOIT\_KIT Malicious TA2726 TDS Domain in DNS Lookup (training .preschoolproblems .com) (exploit\_kit.rules)
- 2060956 - ET EXPLOIT\_KIT Malicious TA2726 TDS Domain in TLS SNI (training .preschoolproblems .com) (exploit\_kit.rules)

### Pro:

- 2860792 - ETPRO MALWARE TA453 CnC Activity (GET) (malware.rules)
- 2860793 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2860794 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2860795 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2860796 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2860797 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2860798 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2860799 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2860800 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2860801 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)