# Ruleset Update Summary - 2025/03/24 - v10889

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-24-v10889/2559>\
**Category:** Ruleset Updates\
**Created:** [March 24, 2025, 8:56pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-24-v10889/2559 "2025-03-24T20:56:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [March 24, 2025, 8:56pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-03-24-v10889/2559/1 "2025-03-24T20:56:17Z")

</div>

## Summary:

19 new OPEN, 30 new PRO (19 + 11)

Thanks @monitorsg

* * *

## Added rules:

### Open:

- 2061021 - ET MALWARE SvcStealer CNC Tasking Checkin (malware.rules)
- 2061022 - ET MALWARE SvcStealer Data Exfiltration Attempt (malware.rules)
- 2061023 - ET INFO DYNAMIC\_DNS Query to a \*.savwhatsup .com domain (info.rules)
- 2061024 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.savwhatsup .com domain (info.rules)
- 2061025 - ET MALWARE Specter Insight Beacon CnC Checkin (malware.rules)
- 2061026 - ET WEB\_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) (web\_server.rules)
- 2061027 - ET WEB\_SPECIFIC\_APPS Discourse Backup File Disclosure via Default Nginx Configuration (CVE-2024-53991) (web\_specific\_apps.rules)
- 2061028 - ET INFO Observed DNS Query to Abused File Sharing Domain in DNS Lookup (filebin .net) (info.rules)
- 2061029 - ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net) (info.rules)
- 2061030 - ET INFO DYNAMIC\_DNS Query to a \*.kick .sh domain (info.rules)
- 2061031 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.kick .sh domain (info.rules)
- 2061032 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (wccdefense .com) (exploit\_kit.rules)
- 2061033 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (pdmfg .com) (exploit\_kit.rules)
- 2061034 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (wccdefense .com) (exploit\_kit.rules)
- 2061035 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (pdmfg .com) (exploit\_kit.rules)
- 2061036 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (cryptohardware .shop) (exploit\_kit.rules)
- 2061037 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (cryptohardware .shop) (exploit\_kit.rules)
- 2061038 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (phpmyadmin .artisticglassstudio .com) (malware.rules)
- 2061039 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (phpmyadmin .artisticglassstudio .com) (malware.rules)

### Pro:

- 2860857 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2860858 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2860859 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2860860 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2860861 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2860862 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2860863 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2860864 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2860865 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
- 2860866 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
- 2860883 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)