# Ruleset Update Summary - 2025/05/08 - v10923 **URL:** \ **Category:** Ruleset Updates\ **Created:** [May 8, 2025, 10:12pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-08-v10923/2721 "2025-05-08T22:12:42Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [May 8, 2025, 10:12pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-08-v10923/2721/1 "2025-05-08T22:12:42Z")
## Summary: 51 new OPEN, 51 new PRO (51 + 0) Thanks @Cyberteam008, @cyber\_ra1 * * * ## Added rules: ### Open: - 2062169 - ET WEB\_SPECIFIC\_APPS Tenda P2pListFilter page Parameter Buffer Overflow Attempt (web\_specific\_apps.rules) - 2062170 - ET WEB\_SPECIFIC\_APPS Tenda L7Im page Parameter Buffer Overflow Attempt (web\_specific\_apps.rules) - 2062171 - ET WEB\_SPECIFIC\_APPS Totolink formPortFw service\_type Parameter Buffer Overflow Attempt (CVE-2025-3988) (web\_specific\_apps.rules) - 2062172 - ET WEB\_SPECIFIC\_APPS Totolink BufferOverflow Attempt multiple URI endpoints submit-url Parameter Buffer Overflow Attempt (CVE-2025-3990-2025-3993) (web\_specific\_apps.rules) - 2062173 - ET MALWARE AresRAT CnC Exfil (POST) (malware.rules) - 2062174 - ET MALWARE AresRAT CnC Checkin (POST) (malware.rules) - 2062175 - ET WEB\_SPECIFIC\_APPS Totolink BufferOverflow Attempt formWsc localPin Parameter Buffer Overflow Attempt (web\_specific\_apps.rules) - 2062176 - ET WEB\_SPECIFIC\_APPS Totolink BufferOverflow Attempt formRoute metric Parameter Denial of Service Attempt (web\_specific\_apps.rules) - 2062177 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (apronsxrum .digital) (malware.rules) - 2062178 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (apronsxrum .digital) in TLS SNI (malware.rules) - 2062179 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ariosefqcu .shop) (malware.rules) - 2062180 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ariosefqcu .shop) in TLS SNI (malware.rules) - 2062181 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (descenrugb .bet) (malware.rules) - 2062182 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (descenrugb .bet) in TLS SNI (malware.rules) - 2062183 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grizzlqzuk .live) (malware.rules) - 2062184 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grizzlqzuk .live) in TLS SNI (malware.rules) - 2062185 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (homelecyfi .digital) (malware.rules) - 2062186 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (homelecyfi .digital) in TLS SNI (malware.rules) - 2062187 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (homewappzb .top) (malware.rules) - 2062188 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (homewappzb .top) in TLS SNI (malware.rules) - 2062189 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (insidegrah .run) (malware.rules) - 2062190 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (insidegrah .run) in TLS SNI (malware.rules) - 2062191 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (octalfbsh .bet) (malware.rules) - 2062192 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (octalfbsh .bet) in TLS SNI (malware.rules) - 2062193 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (onemiltxny .shop) (malware.rules) - 2062194 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (onemiltxny .shop) in TLS SNI (malware.rules) - 2062195 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (quaestort .live) (malware.rules) - 2062196 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (quaestort .live) in TLS SNI (malware.rules) - 2062197 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (romulusy .digital) (malware.rules) - 2062198 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (romulusy .digital) in TLS SNI (malware.rules) - 2062199 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sidebyafzy .digital) (malware.rules) - 2062200 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sidebyafzy .digital) in TLS SNI (malware.rules) - 2062201 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stuffgull .top) (malware.rules) - 2062202 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stuffgull .top) in TLS SNI (malware.rules) - 2062203 - ET WEB\_SPECIFIC\_APPS Totolink BufferOverflow Attempt formWsc localPin Command Injection Attempt (CVE-2025-3987) (web\_specific\_apps.rules) - 2062204 - ET WEB\_SPECIFIC\_APPS Tenda dhcpsCfgSet altDNS parameter Buffer Overflow Attempt (CVE-2025-4007) (web\_specific\_apps.rules) - 2062205 - ET WEB\_SPECIFIC\_APPS Tenda sysUplinkCheckSet hostIp parameters Buffer Overflow Attempt (CVE-2025-3820) (web\_specific\_apps.rules) - 2062206 - ET WEB\_SPECIFIC\_APPS Tenda sysScheduleRebootSet rebootDate parameter Buffer Overflow Attempt (CVE-2025-3803) (web\_specific\_apps.rules) - 2062207 - ET WEB\_SPECIFIC\_APPS Tenda pingSet pingIp parameter Buffer Overflow Attempt (CVE-2023-50991) (web\_specific\_apps.rules) - 2062208 - ET WEB\_SPECIFIC\_APPS Tenda wifiRadioSetIndoor extChannel parameter Buffer Overflow Attempt (CVE-2025-3693) (web\_specific\_apps.rules) - 2062209 - ET WEB\_SPECIFIC\_APPS Totolink EX1800T setWiFiExtenderConfig apcliKey/key command injection attempt (CVE-2025-2094) (web\_specific\_apps.rules) - 2062210 - ET EXPLOIT\_KIT Observed DNS Query to Clickfix Domain (wwwcloudfiare .com) (exploit\_kit.rules) - 2062211 - ET EXPLOIT\_KIT Observed DNS Query to Clickfix Domain (wwwc1oudflare .com) (exploit\_kit.rules) - 2062212 - ET EXPLOIT\_KIT Observed DNS Query to Clickfix Domain (wwwcioudflare .com) (exploit\_kit.rules) - 2062213 - ET EXPLOIT\_KIT Observed ClickFix Domain (wwwcloudfiare .com in TLS SNI) (exploit\_kit.rules) - 2062214 - ET EXPLOIT\_KIT Observed ClickFix Domain (wwwc1oudflare .com in TLS SNI) (exploit\_kit.rules) - 2062215 - ET EXPLOIT\_KIT Observed ClickFix Domain (wwwcioudflare .com in TLS SNI) (exploit\_kit.rules) - 2062216 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (motocyclenews .top) (exploit\_kit.rules) - 2062217 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (motocyclenews .top) (exploit\_kit.rules) - 2062218 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (www .thefertilemine .com) (malware.rules) - 2062219 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (www .thefertilemine .com) (malware.rules) * * * ## Disabled and modified rules: - 2850704 - ETPRO MALWARE Loozer Stealer Activity M6 (malware.rules) - 2861596 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2861599 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2861601 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2861606 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2861607 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2861608 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)