# Ruleset Update Summary - 2025/07/09 - v10966

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-07-09-v10966/2881>\
**Category:** Ruleset Updates\
**Created:** [July 9, 2025, 8:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-07-09-v10966/2881 "2025-07-09T20:02:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [July 9, 2025, 8:02pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-07-09-v10966/2881/1 "2025-07-09T20:02:49Z")

</div>

## Summary:

18 new OPEN, 41 new PRO (18 + 23)

Thanks @sud0woodo, @haxrob

* * *

## Added rules:

### Open:

- 2063361 - ET INFO Monitic RMM API Activity (Agent Ping) (info.rules)
- 2063362 - ET EXPLOIT\_KIT Keitaro TDS Domain in DNS Lookup (privatephotos .online) (exploit\_kit.rules)
- 2063363 - ET EXPLOIT\_KIT Keitaro TDS Domain in TLS SNI (privatephotos .online) (exploit\_kit.rules)
- 2063364 - ET INAPPROPRIATE Evil Keitaro to Adult Websites Set-Cookie Inbound (3f06b) (inappropriate.rules)
- 2063365 - ET EXPLOIT Microsoft Sharepoint WebPartPagesWebService Authenticated Remote Code Execution (CVE-2023-21742) (exploit.rules)
- 2063366 - ET WEB\_SPECIFIC\_APPS Anthropic MCP Inspector Proxy Server-Sent Events (SSE) Unauthenticated Remote Code Execution (CVE-2025-49596) (web\_specific\_apps.rules)
- 2063367 - ET EXPLOIT GTPDoor Trigger Packet Request (exploit.rules)
- 2063368 - ET EXPLOIT GTPDoor Trigger Packet Response (exploit.rules)
- 2063369 - ET INFO Invalid GTP Response Packet Observed (info.rules)
- 2063370 - ET WEB\_SPECIFIC\_APPS D-Link switch\_language.cgi language Parameter Buffer Overflow (CVE-2025-7206) (web\_specific\_apps.rules)
- 2063371 - ET MALWARE Amatera Stealer CnC Checkin Attempt M2 (malware.rules)
- 2063372 - ET MALWARE Amatera Stealer CnC Exfil (POST) M3 (malware.rules)
- 2063373 - ET MALWARE Amatera Stealer CnC Exfil (POST) M4 (malware.rules)
- 2063374 - ET MALWARE Win32/TA569 Gholoader CnC Domain in DNS Lookup (assets .studermfg .com) (malware.rules)
- 2063375 - ET MALWARE Win32/TA569 Gholoader CnC Domain in TLS SNI (assets .studermfg .com) (malware.rules)
- 2063376 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (trendings .top) (exploit\_kit.rules)
- 2063377 - ET MALWARE GTPDoor Ack Beacon Request (TCP) (malware.rules)
- 2063378 - ET MALWARE GTPDoor Client Beacon Response (TCP) (malware.rules)

### Pro:

- 2863406 - ETPRO HUNTING Microsoft SQL Server Unauthorized Information Disclosure (CVE-2025-49718) (hunting.rules)
- 2863408 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2863409 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2863410 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2863411 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2863412 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2863413 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2863414 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2863415 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2863416 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules)
- 2863417 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules)
- 2863418 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules)
- 2863419 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules)
- 2863420 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules)
- 2863421 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules)
- 2863422 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules)
- 2863423 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules)
- 2863424 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2863425 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2863426 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2863427 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2863428 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)
- 2863429 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules)