Ruleset Update Summary - 2025/05/09 - v10924

Ruleset Updates
1

Summary:

9 new OPEN, 9 new PRO (9 + 0)

Thanks @OligoSecurity

Added rules:

Open:

  • 2062220 - ET HUNTING Observed Possible Fake Updates/Login Domain (security-check-… in TLS SNI) (hunting.rules)
  • 2062221 - ET HUNTING Observed DNS Query to Possible Fake Updates/Login Domain (security-check-…) (hunting.rules)
  • 2062222 - ET EXPLOIT_KIT DollyWay v3 PHP TDS Redirect (exploit_kit.rules)
  • 2062223 - ET EXPLOIT_KIT DollyWay v3 PHP TDS (data.txt) (exploit_kit.rules)
  • 2062224 - ET WEB_SPECIFIC_APPS Ray Framework (ShadowRay) Unauthenticated Jobs API Command Execution (CVE-2023-48022) (web_specific_apps.rules)
  • 2062225 - ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (my-privatebanker .top) (exploit_kit.rules)
  • 2062226 - ET EXPLOIT_KIT ZPHP Domain in TLS SNI (my-privatebanker .top) (exploit_kit.rules)
  • 2062227 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cpanel .santechplumbing .com) (malware.rules)
  • 2062228 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cpanel .santechplumbing .com) (malware.rules)