# Ruleset Update Summary - 2025/08/04 - v10985

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-08-04-v10985/2946>\
**Category:** Ruleset Updates\
**Created:** [August 4, 2025, 10:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-08-04-v10985/2946 "2025-08-04T22:39:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [August 4, 2025, 10:39pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-08-04-v10985/2946/1 "2025-08-04T22:39:30Z")

</div>

## Summary:

22 new OPEN, 28 new PRO (22 + 6)

Thanks @Malwarebytes

* * *

## Added rules:

### Open:

- 2063879 - ET INFO DYNAMIC\_DNS Query to a \*.clandestina .org domain (info.rules)
- 2063880 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.clandestina .org domain (info.rules)
- 2063881 - ET INFO DYNAMIC\_DNS Query to a \*.meteotodi .it domain (info.rules)
- 2063882 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.meteotodi .it domain (info.rules)
- 2063883 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bittsgly .my) (malware.rules)
- 2063884 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (bittsgly .my) in TLS SNI (malware.rules)
- 2063885 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (akkeod .com) (malware.rules)
- 2063886 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (akkeod .com) in TLS SNI (malware.rules)
- 2063887 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mocadia .com) (malware.rules)
- 2063888 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (mocadia .com) in TLS SNI (malware.rules)
- 2063889 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (templfuw .my) (malware.rules)
- 2063890 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (templfuw .my) in TLS SNI (malware.rules)
- 2063891 - ET WEB\_SPECIFIC\_APPS Ilevia EVE X1 Server Command Injection Attempt (web\_specific\_apps.rules)
- 2063892 - ET WEB\_SPECIFIC\_APPS Ilevia EVE X1 Server dbcheck.php db\_log parameter Pre-Auth File Disclosure Attempt (web\_specific\_apps.rules)
- 2063893 - ET MALWARE Stealerium CnC Exfil via Discord (POST) (malware.rules)
- 2063894 - ET WEB\_SPECIFIC\_APPS ABB Cylon Aspect Unauthenticated Directory Traversal and Arbitrary File Upload Attempt (web\_specific\_apps.rules)
- 2063895 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (docs .nynovation .com) (malware.rules)
- 2063896 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (docs .nynovation .com) (malware.rules)
- 2063897 - ET MALWARE Observed DNS Query to Vidar Stealer Domain (soft-gets .com) (malware.rules)
- 2063898 - ET MALWARE Observed DNS Query to Vidar Stealer Domain (reaitek .com) (malware.rules)
- 2063899 - ET MALWARE Observed Vidar Stealer Domain (soft-gets .com in TLS SNI) (malware.rules)
- 2063900 - ET MALWARE Observed Vidar Stealer Domain (reaitek .com in TLS SNI) (malware.rules)

### Pro:

- 2863971 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
- 2863972 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)
- 2863995 - ETPRO MALWARE Observed TA455 Style URI (malware.rules)
- 2863996 - ETPRO PHISHING TA4903 Domain in DNS Lookup (phishing.rules)
- 2863997 - ETPRO PHISHING TA4903 Domain in TLS SNI (phishing.rules)
- 2863998 - ETPRO HUNTING Observed Suspicious Character Escape Sequence Often Used In Command Injection Attempts (hunting.rules)

* * *

## Modified inactive rules:

- 2048902 - ET MALWARE [ANY.RUN] zgRAT / PureLogs Stealer C2 Connection M1 (malware.rules)