# Ruleset Update Summary - 2025/05/06 - v10921 **URL:** \ **Category:** Ruleset Updates\ **Created:** [May 6, 2025, 9:18pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-06-v10921/2709 "2025-05-06T21:18:15Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [May 6, 2025, 9:18pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-06-v10921/2709/1 "2025-05-06T21:18:15Z")
## Summary: 19 new OPEN, 27 new PRO (19 + 8) Thanks @msftsecurity * * * ## Added rules: ### Open: - 2062126 - ET INFO Teleport Service Domain (teleport .sh) in DNS Lookup (info.rules) - 2062127 - ET INFO Teleport Service Domain (teleport .dev) in DNS Lookup (info.rules) - 2062128 - ET INFO Teleport Service Domain (goteleport .com) in DNS Lookup (info.rules) - 2062129 - ET INFO Observed Teleport Service Domain (teleport .sh) in TLS SNI (info.rules) - 2062130 - ET INFO Observed Teleport Service Domain (teleport .dev) in TLS SNI (info.rules) - 2062131 - ET INFO Observed Teleport Service Domain (goteleport .com) in TLS SNI (info.rules) - 2062132 - ET MALWARE Observed DNS Query to MeshAgent Domain (mesh .i .nsat .ca) (malware.rules) - 2062133 - ET MALWARE Observed MeshAgent Domain (mesh .i .nsat .ca in TLS SNI) (malware.rules) - 2062134 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hackergala .digital) (malware.rules) - 2062135 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (hackergala .digital) in TLS SNI (malware.rules) - 2062136 - ET WEB\_SPECIFIC\_APPS Samsung MagicINFO SWUpdateFileUploader fileName parameter Directory Traversal Attempt (CVE-2024-7399) (web\_specific\_apps.rules) - 2062137 - ET WEB\_SPECIFIC\_APPS DigiEver DS-2105 Pro time\_tzsetup.cgi ntp Parameter Command Injection Attempt (CVE-2023-52163) (web\_specific\_apps.rules) - 2062138 - ET MALWARE Observed DNS Query to BlackByte Ransomware Domain (myvisit .alteksecurity .org) (malware.rules) - 2062139 - ET MALWARE Observed BlackByte Domain (myvisit .alteksecurity .org in TLS SNI) (malware.rules) - 2062140 - ET WEB\_SPECIFIC\_APPS GeoVision DateSetting.cgi szSrvIpAddr Parameter Command Injection Attempt (web\_specific\_apps.rules) - 2062141 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (anncrman .com) (exploit\_kit.rules) - 2062142 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (anncrman .com) (exploit\_kit.rules) - 2062143 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (email .gwlawgroupattorneys .com) (malware.rules) - 2062144 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (email .gwlawgroupattorneys .com) (malware.rules) ### Pro: - 2861581 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2861582 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2861583 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2861584 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2861585 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2861586 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2861587 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2861588 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) * * * ## Disabled and modified rules: - 2861353 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861354 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861355 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861356 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861357 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861358 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861359 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861360 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861361 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861362 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861363 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861364 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861365 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861367 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861511 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules) - 2861512 - ETPRO PHISHING TA453 Domain in DNS Lookup (phishing.rules)