# Ruleset Update Summary - 2025/09/24 - v11023 **URL:** \ **Category:** Ruleset Updates\ **Created:** [September 24, 2025, 8:28pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-09-24-v11023/3052 "2025-09-24T20:28:12Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [September 24, 2025, 8:28pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-09-24-v11023/3052/1 "2025-09-24T20:28:12Z")
## Summary: 30 new OPEN, 32 new PRO (30 + 2) * * * ## Added rules: ### Open: - 2064887 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (members .aielloscigarbar .com) (malware.rules) - 2064888 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (members .aielloscigarbar .com) (malware.rules) - 2064889 - ET INFO DYNAMIC\_DNS Query to a \*.ingredientsplus .com .my domain (info.rules) - 2064890 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.ingredientsplus .com .my domain (info.rules) - 2064891 - ET INFO DYNAMIC\_DNS Query to a \*.thisisnothing .pw domain (info.rules) - 2064892 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.thisisnothing .pw domain (info.rules) - 2064893 - ET INFO DYNAMIC\_DNS Query to a \*.lamichhaneprakash .com .np domain (info.rules) - 2064894 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.lamichhaneprakash .com .np domain (info.rules) - 2064895 - ET INFO DYNAMIC\_DNS Query to a \*.rauszeiter .ch domain (info.rules) - 2064896 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.rauszeiter .ch domain (info.rules) - 2064897 - ET INFO DYNAMIC\_DNS Query to a \*.mecanicatecnicar .com .ar domain (info.rules) - 2064898 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.mecanicatecnicar .com .ar domain (info.rules) - 2064899 - ET INFO DYNAMIC\_DNS Query to a \*.tirri .com .ar domain (info.rules) - 2064900 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.tirri .com .ar domain (info.rules) - 2064901 - ET INFO DYNAMIC\_DNS Query to a \*.stadtwandern .ch domain (info.rules) - 2064902 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.stadtwandern .ch domain (info.rules) - 2064903 - ET INFO DYNAMIC\_DNS Query to a \*.dikpalkc .com .np domain (info.rules) - 2064904 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.dikpalkc .com .np domain (info.rules) - 2064905 - ET INFO DYNAMIC\_DNS Query to a \*.qwe-qwe .me domain (info.rules) - 2064906 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.qwe-qwe .me domain (info.rules) - 2064907 - ET INFO DYNAMIC\_DNS Query to a \*.clientesussalarmas .com .ar domain (info.rules) - 2064908 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.clientesussalarmas .com .ar domain (info.rules) - 2064909 - ET INFO DYNAMIC\_DNS Query to a \*.auszeit-seminar .ch domain (info.rules) - 2064910 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.auszeit-seminar .ch domain (info.rules) - 2064911 - ET INFO DYNAMIC\_DNS Query to a \*.primebuildings .bg domain (info.rules) - 2064912 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.primebuildings .bg domain (info.rules) - 2064913 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (delfxus .today) (malware.rules) - 2064914 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (delfxus .today) in TLS SNI (malware.rules) - 2064915 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (noticedseuh .icu) (malware.rules) - 2064916 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (noticedseuh .icu) in TLS SNI (malware.rules) ### Pro: - 2864689 - ETPRO MALWARE UNK\_BlackGold CnC Response (malware.rules) - 2864690 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) * * * ## Modified inactive rules: - 2027167 - ET NETBIOS DCERPC WMI Remote Process Execution (netbios.rules) - 2027176 - ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement (policy.rules) - 2027187 - ET POLICY Net View Command in SMB Traffic - Likely Lateral Movement (policy.rules) - 2027188 - ET POLICY Net View Command in SMB Traffic - Likely Lateral Movement (policy.rules) - 2027190 - ET NETBIOS DCERPC DCOM ShellExecute - Likely Lateral Movement (netbios.rules) - 2027191 - ET POLICY Executable Transfer in SMB (policy.rules) - 2027222 - ET MALWARE Observed Malicious SSL Cert (Unattributed CnC) (malware.rules) - 2027223 - ET MALWARE Observed Malicious SSL Cert (Unattributed CnC) (malware.rules) - 2027414 - ET MALWARE Observed Malicious SSL Cert (BrushaLoader CnC) 2019-05-30 (malware.rules) - 2027445 - ET MALWARE Buran Ransomware Activity M2 (malware.rules) - 2834920 - ETPRO MALWARE Brushaloader Domain in DNS Lookup (malware.rules) - 2835199 - ETPRO MALWARE Observed Malicious SSL Cert (Cobalt Strike CnC) (malware.rules) - 2835695 - ETPRO MALWARE Observed Malicious SSL Cert (Ursnif CnC) (malware.rules) - 2835753 - ETPRO MALWARE Win32.Floxif.H Checkin (malware.rules) - 2835824 - ETPRO MALWARE Observed Malicious SSL Cert (Ursnif CnC) (malware.rules) - 2835851 - ETPRO WEB\_CLIENT VBScript Heap Overflow CVE-2019-0666 (web\_client.rules) - 2835917 - ETPRO MALWARE Observed Malicious SSL Cert (CoreDn Activity) (malware.rules) - 2836269 - ETPRO MALWARE QuasarRAT C2 KeepAlive (malware.rules) - 2836297 - ETPRO MALWARE Win32/Pterodo.NG Checkin 3 (malware.rules) - 2836743 - ETPRO MALWARE MuddyWater PowerShell RAT Check-in (malware.rules) - 2836902 - ETPRO MALWARE Suspected APT33 Spearphishing Related DNS Lookup (malware.rules)