# Ruleset Update Summary - 2025/05/09 - v10924 **URL:** \ **Category:** Ruleset Updates\ **Created:** [May 9, 2025, 8:35pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-09-v10924/2723 "2025-05-09T20:35:32Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [May 9, 2025, 8:35pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-09-v10924/2723/1 "2025-05-09T20:35:32Z")
## Summary: 9 new OPEN, 9 new PRO (9 + 0) Thanks @OligoSecurity * * * ## Added rules: ### Open: - 2062220 - ET HUNTING Observed Possible Fake Updates/Login Domain (security-check-… in TLS SNI) (hunting.rules) - 2062221 - ET HUNTING Observed DNS Query to Possible Fake Updates/Login Domain (security-check-…) (hunting.rules) - 2062222 - ET EXPLOIT\_KIT DollyWay v3 PHP TDS Redirect (exploit\_kit.rules) - 2062223 - ET EXPLOIT\_KIT DollyWay v3 PHP TDS (data.txt) (exploit\_kit.rules) - 2062224 - ET WEB\_SPECIFIC\_APPS Ray Framework (ShadowRay) Unauthenticated Jobs API Command Execution (CVE-2023-48022) (web\_specific\_apps.rules) - 2062225 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (my-privatebanker .top) (exploit\_kit.rules) - 2062226 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (my-privatebanker .top) (exploit\_kit.rules) - 2062227 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (cpanel .santechplumbing .com) (malware.rules) - 2062228 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (cpanel .santechplumbing .com) (malware.rules)