# Ruleset Update Summary - 2025/10/16 - v11041

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-10-16-v11041/3083>\
**Category:** Ruleset Updates\
**Created:** [October 16, 2025, 8:15pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-10-16-v11041/3083 "2025-10-16T20:15:53Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [October 16, 2025, 8:15pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-10-16-v11041/3083/1 "2025-10-16T20:15:53Z")

</div>

## Summary:

18 new OPEN, 18 new PRO (18 + 0)

* * *

## Added rules:

### Open:

- 2065216 - ET WEB\_SPECIFIC\_APPS OptiLink/GPON admin/formTracert target\_addr Parameter Command Injection Attempt (CVE-2025-34049) (web\_specific\_apps.rules)
- 2065217 - ET WEB\_SPECIFIC\_APPS Syrotec/GPON shellCMDExec command Parameter Command Injection Attempt (CVE-2024-46658) (web\_specific\_apps.rules)
- 2065218 - ET WEB\_SPECIFIC\_APPS Planet formPingCmd Multiple Parameters Command Injection Attempt (CVE-2025-54405, CVE-2025-54406) (web\_specific\_apps.rules)
- 2065219 - ET WEB\_SPECIFIC\_APPS Planet formPingCmd Multiple Parameters Buffer Overflow Attempt (CVE-2025-54399, CVE-2025-54400, CVE-2025-54401, CVE-2025-54402) (web\_specific\_apps.rules)
- 2065220 - ET WEB\_SPECIFIC\_APPS ByteValue webRead/open path Parameter Command Injection Attempt (CVE-2023-7011) (web\_specific\_apps.rules)
- 2065221 - ET WEB\_SPECIFIC\_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156) (web\_specific\_apps.rules)
- 2065222 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (manage .veranoresorts .com) (malware.rules)
- 2065223 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (manage .veranoresorts .com) (malware.rules)
- 2065224 - ET MALWARE Observed DNS Query to Cobalt Strike Domain (cloudflarecache .cfd) (malware.rules)
- 2065225 - ET MALWARE Observed DNS Query to Cobalt Strike Domain (bootcdncache .com) (malware.rules)
- 2065226 - ET MALWARE Observed Cobalt Strike Domain (cloudflarecache .cfd in TLS SNI) (malware.rules)
- 2065227 - ET MALWARE Observed Cobalt Strike Domain (bootcdncache .com in TLS SNI) (malware.rules)
- 2065228 - ET WEB\_SPECIFIC\_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238) (web\_specific\_apps.rules)
- 2065229 - ET MALWARE Cobalt Strike Get Mission Request (POST) (malware.rules)
- 2065230 - ET MALWARE Cobalt Strike CnC Checkin (Submit Result) (malware.rules)
- 2065231 - ET MALWARE Cobalt Strike ScreenShot Exfil (POST) (malware.rules)
- 2065232 - ET WEB\_SPECIFIC\_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238) (web\_specific\_apps.rules)
- 2065233 - ET WEB\_SPECIFIC\_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238) (web\_specific\_apps.rules)

* * *

## Modified inactive rules:

- 2002088 - ET ADWARE\_PUP [C4tdownload.com](http://C4tdownload.com) Spyware Activity (adware\_pup.rules)
- 2002129 - ET WEB\_SPECIFIC\_APPS Cacti Input Validation Attack (web\_specific\_apps.rules)
- 2002824 - ET POLICY CURL User Agent (policy.rules)
- 2002887 - ET EXPLOIT SYS get\_domain\_index\_tables Access (exploit.rules)
- 2007878 - ET ACTIVEX Apple QuickTime \<= 7.4.1 QTPlugin.ocx Multiple Remote Stack Overflow (activex.rules)
- 2007981 - ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Acknowledge (malware.rules)
- 2008456 - ET ADWARE\_PUP EMO/PCPrivacyCleaner Rougue Secuirty App GET Checkin (adware\_pup.rules)
- 2010510 - ET WEB\_SPECIFIC\_APPS Possible OSSIM uniqueid Parameter Remote Command Execution Attempt (web\_specific\_apps.rules)
- 2011334 - ET ADWARE\_PUP User-Agent (C\WINDOWS\system32\NetLogom.exe) (adware\_pup.rules)
- 2012777 - ET HUNTING Suspicious IAT EnableExecuteProtectionSupport - Undocumented API to Modify DEP (hunting.rules)
- 2013020 - ET MOBILE\_MALWARE DroidKungFu Checkin (mobile\_malware.rules)
- 2013490 - ET POLICY NetBIOS nbtstat Type Query Outbound (policy.rules)
- 2014458 - ET CURRENT\_EVENTS Italian Spam Campaign (current\_events.rules)
- 2016709 - ET EXPLOIT\_KIT CrimeBoss Recent Jar (4) (exploit\_kit.rules)
- 2016828 - ET EXPLOIT\_KIT Unknown EK Requsting Payload (exploit\_kit.rules)
- 2017743 - ET CURRENT\_EVENTS Possible WhiteLotus IE Payload (current\_events.rules)
- 2017744 - ET EXPLOIT\_KIT StyX EK Payload Cookie (exploit\_kit.rules)
- 2018698 - ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2) (malware.rules)
- 2018866 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2) (malware.rules)
- 2018987 - ET EXPLOIT\_KIT Sweet Orange EK Thread Specific Java Exploit (exploit\_kit.rules)
- 2019395 - ET MALWARE Possible SandWorm INF Download (malware.rules)
- 2019550 - ET MALWARE Sofacy HTTP Request [checkwinframe.com](http://checkwinframe.com) (malware.rules)
- 2021258 - ET WEB\_CLIENT Fake AV Phone Scam Landing June 11 2015 M3 (web\_client.rules)
- 2021975 - ET WEB\_CLIENT Fake Virus Phone Scam Landing Oct 19 M5 (web\_client.rules)
- 2022417 - ET MALWARE Scarlet Mimic DNS Lookup 7 (malware.rules)
- 2023269 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars MITM) (malware.rules)
- 2100197 - GPL ICMP undefined code (icmp.rules)
- 2101838 - GPL EXPLOIT SSH server banner overflow (exploit.rules)
- 2800846 - ETPRO MALWARE Worm.Win32.Faketube Activity (update request) (malware.rules)
- 2801276 - ETPRO EXPLOIT HP OpenView Network Node Manager nnmRptConfig.exe nameParams text1 Buffer Overflow (exploit.rules)
- 2801281 - ETPRO EXPLOIT NetSupport Manager Client Buffer Overflow Relative (exploit.rules)
- 2803228 - ETPRO CHAT mig33 Server Registered OK (chat.rules)
- 2803385 - ETPRO EXPLOIT Sybase Open Server Null Byte Stack Memory Corruption (exploit.rules)
- 2804127 - ETPRO MALWARE Trojan.Autoit.F Checkin (malware.rules)
- 2804301 - ETPRO MALWARE Win32/TrojanDownloader.Banload.QOM Checkin (malware.rules)
- 2804961 - ETPRO MALWARE W32/Karagany.TK Checkin (malware.rules)
- 2805382 - ETPRO MALWARE Trojan-Dropper.Win32.Daws.atjm Checkin (malware.rules)
- 2805701 - ETPRO MALWARE Win32/Phintok.A Checkin 1 (malware.rules)
- 2807643 - ETPRO WEB\_CLIENT Microsoft Internet Explorer Use After free (CVE-2014-0273) (web\_client.rules)
- 2807644 - ETPRO WEB\_CLIENT Microsoft Internet Explorer Use After free (CVE-2014-0274) (web\_client.rules)
- 2808889 - ETPRO MOBILE\_MALWARE Backdoor.AndroidOS.Masnu.a Checkin (mobile\_malware.rules)
- 2808890 - ETPRO MOBILE\_MALWARE Android.Trojan.SMSSend.CH Checkin (mobile\_malware.rules)
- 2809488 - ETPRO DOS MS RADIUS DoS Vulnerability CVE-2015-0015 (dos.rules)
- 2809489 - ETPRO DOS MS RADIUS DoS Vulnerability CVE-2015-0015 (dos.rules)
- 2814652 - ETPRO EXPLOIT\_KIT Magnitude EK Landing Oct 27 2015 (exploit\_kit.rules)
- 2814848 - ETPRO EXPLOIT\_KIT Magnitude EK Landing Nov 10 2015 M1 (exploit\_kit.rules)
- 2816162 - ETPRO MALWARE Possible Ironhalo Receiving Encoded Payload M2 (malware.rules)
- 2816758 - ETPRO MALWARE Ursnif Injects Domain in SSL Client Hello (malware.rules)
- 2819648 - ETPRO EXPLOIT\_KIT SunDown/Xer Payload (URL Primer) (exploit\_kit.rules)
- 2819928 - ETPRO MOBILE\_MALWARE Android.Trojan.InfoStealer.CH Checkin (mobile\_malware.rules)
- 2820563 - ETPRO EXPLOIT\_KIT Magnitude EK Landing Jun 10 2016 (exploit\_kit.rules)