# Ruleset Update Summary - 2025/09/18 - v11019 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 18, 2025, 8:26pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-09-18-v11019/3042 "2025-09-18T20:26:34Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 18, 2025, 8:26pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-09-18-v11019/3042/1 "2025-09-18T20:26:34Z")
## Summary: 26 new OPEN, 30 new PRO (26 + 4) Thanks @osint\_barbie * * * ## Added rules: ### Open: - 2064776 - ET MALWARE FrigidBackdoor Health Check (malware.rules) - 2064777 - ET MALWARE FrigidBackdoor Exfil Zip (malware.rules) - 2064778 - ET MALWARE FrigidBackdoor Request ZIP (malware.rules) - 2064779 - ET MALWARE FrigidBackdoor Log Results (malware.rules) - 2064780 - ET EXPLOIT\_KIT Malicious TA2727 TDS Domain in DNS Lookup (00704ae865ee .ngrok .app) (exploit\_kit.rules) - 2064781 - ET EXPLOIT\_KIT Malicious TA2727 TDS Domain in TLS SNI (00704ae865ee .ngrok .app) (exploit\_kit.rules) - 2064782 - ET INFO DYNAMIC\_DNS Query to a \*.premnewar .com .np domain (info.rules) - 2064783 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.premnewar .com .np domain (info.rules) - 2064784 - ET INFO DYNAMIC\_DNS Query to a \*.carluciocruzfotografia .com .br domain (info.rules) - 2064785 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.carluciocruzfotografia .com .br domain (info.rules) - 2064786 - ET INFO DYNAMIC\_DNS Query to a \*.sojda .org domain (info.rules) - 2064787 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.sojda .org domain (info.rules) - 2064788 - ET EXPLOIT\_KIT Observed DNS Query to ClickFix Domain (lehmanpipe .com) (exploit\_kit.rules) - 2064789 - ET EXPLOIT\_KIT Observed ClickFix Domain (lehmanpipe .com in TLS SNI) (exploit\_kit.rules) - 2064790 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (external .eliteworkxmarketing .com) (malware.rules) - 2064791 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (schedule .eliteworkxmarketing .com) (malware.rules) - 2064792 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (external .eliteworkxmarketing .com) (malware.rules) - 2064793 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (schedule .eliteworkxmarketing .com) (malware.rules) - 2064794 - ET WEB\_SPECIFIC\_APPS D-Link set\_server\_settings Multiple Parameters Command Injection Attempt (CVE-2025-10634) (web\_specific\_apps.rules) - 2064795 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (porsasystem .com) (exploit\_kit.rules) - 2064796 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (porsasystem .com) (exploit\_kit.rules) - 2064797 - ET WEB\_SPECIFIC\_APPS D-Link SSDP ST Header Command Injection Attempt (CVE-2025-10629) (web\_specific\_apps.rules) - 2064798 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (retiregenz .com) (exploit\_kit.rules) - 2064799 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (retiregenz .com) (exploit\_kit.rules) - 2064800 - ET WEB\_SPECIFIC\_APPS D-Link hedwig.cgi (DEVICE.TIME) server XML Parameter Command Injection Attempt (CVE-2025-10628) (web\_specific\_apps.rules) - 2064801 - ET WEB\_SPECIFIC\_APPS D-Link apply.cgi countdown\_time Parameter Buffer Overflow Attempt (CVE-2025-10666) (web\_specific\_apps.rules) ### Pro: - 2864620 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2864621 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2864622 - ETPRO MALWARE Observed ClickFix Style URI in HTTP GET (malware.rules) - 2864623 - ETPRO ATTACK\_RESPONSE Shellcode Loader .ps1 Script Inbound (attack\_response.rules) * * * ## Modified inactive rules: - 2030183 - ET MALWARE BigLock Ransomware CnC Activity (gen) (malware.rules) - 2030184 - ET MALWARE BigLock Ransomware CnC Activity (id) (malware.rules) - 2030221 - ET EXPLOIT Possible DNS BIND TSIG Denial of Service Attempt (CVE-2020-8617) (exploit.rules) - 2030249 - ET WEB\_CLIENT Cushion Redirection (web\_client.rules) - 2030342 - ET MOBILE\_MALWARE ActionSpy CnC (POST) (mobile\_malware.rules) - 2030345 - ET SCAN Zmap User-Agent (Outbound) (scan.rules) - 2030521 - ET INFO Suspicious HTTP GET Request on Port 53 Inbound (info.rules) - 2842411 - ETPRO MALWARE Suspected MEDUSA RAT CnC Response (malware.rules) - 2842432 - ETPRO HUNTING Suspected DNSTEAL DNS Traffic (hunting.rules) - 2842774 - ETPRO MALWARE Observed Malicious SSL Cert (AZORult CnC) (malware.rules) - 2842822 - ETPRO MALWARE W32/Sofacy Variant Checkin (malware.rules) - 2844197 - ETPRO MALWARE CaptainCha CnC in DNS Lookup (malware.rules)