# Ruleset Update Summary - 2025/05/20 - v10931 **URL:** \ **Category:** Ruleset Updates\ **Created:** [May 20, 2025, 8:24pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-20-v10931/2747 "2025-05-20T20:24:19Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [May 20, 2025, 8:24pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-05-20-v10931/2747/1 "2025-05-20T20:24:19Z")
## Summary: 36 new OPEN, 36 new PRO (36 + 0) * * * ## Added rules: ### Open: - 2062461 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bubblezdjw .live) (malware.rules) - 2062462 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bubblezdjw .live) in TLS SNI (malware.rules) - 2062463 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (caitraohvi .bet) (malware.rules) - 2062464 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (caitraohvi .bet) in TLS SNI (malware.rules) - 2062465 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (citellcagt .top) (malware.rules) - 2062466 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (citellcagt .top) in TLS SNI (malware.rules) - 2062467 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (escczlv .top) (malware.rules) - 2062468 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (escczlv .top) in TLS SNI (malware.rules) - 2062469 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (galijd .shop) (malware.rules) - 2062470 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (galijd .shop) in TLS SNI (malware.rules) - 2062471 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (genusbwaiw .live) (malware.rules) - 2062472 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (genusbwaiw .live) in TLS SNI (malware.rules) - 2062473 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gettoknwg .life) (malware.rules) - 2062474 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gettoknwg .life) in TLS SNI (malware.rules) - 2062475 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (haircuirfm .top) (malware.rules) - 2062476 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (haircuirfm .top) in TLS SNI (malware.rules) - 2062477 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (leasegjjr .digital) (malware.rules) - 2062478 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (leasegjjr .digital) in TLS SNI (malware.rules) - 2062479 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (maxmtsq .bet) (malware.rules) - 2062480 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (maxmtsq .bet) in TLS SNI (malware.rules) - 2062481 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (moondips .bet) (malware.rules) - 2062482 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (moondips .bet) in TLS SNI (malware.rules) - 2062483 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (shoresolfe .live) (malware.rules) - 2062484 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (shoresolfe .live) in TLS SNI (malware.rules) - 2062485 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (starsciw .shop) (malware.rules) - 2062486 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (starsciw .shop) in TLS SNI (malware.rules) - 2062487 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (threatqjqy .top) (malware.rules) - 2062488 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (threatqjqy .top) in TLS SNI (malware.rules) - 2062489 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trotwhvn .live) (malware.rules) - 2062490 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (trotwhvn .live) in TLS SNI (malware.rules) - 2062491 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (winterghzp .digital) (malware.rules) - 2062492 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (winterghzp .digital) in TLS SNI (malware.rules) - 2062493 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (k2bsc .top) (exploit\_kit.rules) - 2062494 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (k2bsc .top) (exploit\_kit.rules) - 2062495 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (app .nerduptechnology .com) (malware.rules) - 2062496 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (app .nerduptechnology .com) (malware.rules) * * * ## Disabled and modified rules: - 2062315 - ET WEB\_SPECIFIC\_APPS Totolink A3002R formDnsv6 routername Parameter Buffer Overflow Attempt (web\_specific\_apps.rules) - 2062454 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (sorts-pushed-completely-manuals .trycloudflare .com) (exploit\_kit.rules) - 2062455 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (sorts-pushed-completely-manuals .trycloudflare .com) (exploit\_kit.rules) - 2861712 - ETPRO MALWARE Observed DNS Query to TA399/Sidewinder Domain (malware.rules) - 2861716 - ETPRO MALWARE Observed TA399/Sidewinder Domain in TLS SNI (malware.rules) - 2861751 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2861755 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2861760 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2861765 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2861767 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)