# Ruleset Update Summary - 2025/04/02 - v10896 **URL:** \ **Category:** Ruleset Updates\ **Created:** [April 2, 2025, 8:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-04-02-v10896/2590 "2025-04-02T20:39:24Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [April 2, 2025, 8:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-04-02-v10896/2590/1 "2025-04-02T20:39:24Z")
## Summary: 11 new OPEN, 21 new PRO (11 + 10) * * * ## Added rules: ### Open: - 2061246 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (eiesystems .com) (exploit\_kit.rules) - 2061247 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (eiesystems .com) (exploit\_kit.rules) - 2061248 - ET WEB\_SPECIFIC\_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M1 (web\_specific\_apps.rules) - 2061249 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (dcdh4 .shop) (exploit\_kit.rules) - 2061250 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (dcdh4 .shop) (exploit\_kit.rules) - 2061251 - ET WEB\_SPECIFIC\_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M2 (web\_specific\_apps.rules) - 2061252 - ET WEB\_SPECIFIC\_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2022-22274) M3 (web\_specific\_apps.rules) - 2061253 - ET WEB\_SPECIFIC\_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M1 (web\_specific\_apps.rules) - 2061254 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .novelty-press .com) (malware.rules) - 2061255 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .novelty-press .com) (malware.rules) - 2061256 - ET WEB\_SPECIFIC\_APPS SonicWall SonicOS Unauthenticated Stack-Based Buffer Overflow (CVE-2023-0656) M2 (web\_specific\_apps.rules) ### Pro: - 2861024 - ETPRO MALWARE Observed DNS Query to TA453 Domain (malware.rules) - 2861025 - ETPRO MALWARE Observed TA453 Domain in TLS SNI (malware.rules) - 2861026 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2861027 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2861028 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2861029 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2861030 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2861031 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2861032 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2861033 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)