# Ruleset Update Summary - 2025/10/30 - v11052 **URL:** \ **Category:** Ruleset Updates\ **Created:** [October 30, 2025, 8:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-10-30-v11052/3097 "2025-10-30T20:48:27Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [October 30, 2025, 8:48pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-10-30-v11052/3097/1 "2025-10-30T20:48:27Z")
## Summary: 44 new OPEN, 68 new PRO (44 + 24) Please be aware that Friday, 31 October is a Proofpoint company holiday. As such, there will be no daily ruleset update tomorrow. The next daily ruleset update will be on Monday, 3 November. * * * ## Added rules: ### Open: - 2065569 - ET WEB\_SPECIFIC\_APPS Atlassian Confluence Server-Side Request Forgery (CVE-2021-26072) (web\_specific\_apps.rules) - 2065570 - ET WEB\_SPECIFIC\_APPS IPFire fwhosts.cgi COUNTRY\_CODE Parameter Cross Site Scripting Attempt (CVE-2025-34301) (web\_specific\_apps.rules) - 2065571 - ET WEB\_SPECIFIC\_APPS IPFire fwhosts.cgi PROT Parameter Cross Site Scripting Attempt (CVE-2025-34302) (web\_specific\_apps.rules) - 2065572 - ET WEB\_SPECIFIC\_APPS IPFire ids.cgi IGNORE\_ENTRY\_REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34303) (web\_specific\_apps.rules) - 2065573 - ET WEB\_SPECIFIC\_APPS IPFire ovpnclients.dat CONNECTION\_NAME Parameter SQL Injection Attempt (CVE-2025-34304) (web\_specific\_apps.rules) - 2065574 - ET WEB\_SPECIFIC\_APPS IPFire weakeonlan.cgi CLIENT\_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065575 - ET WEB\_SPECIFIC\_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065576 - ET WEB\_SPECIFIC\_APPS IPFire connscheduler.cgi ACTION\_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065577 - ET WEB\_SPECIFIC\_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065578 - ET WEB\_SPECIFIC\_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065579 - ET WEB\_SPECIFIC\_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) (web\_specific\_apps.rules) - 2065580 - ET WEB\_SPECIFIC\_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34306) (web\_specific\_apps.rules) - 2065581 - ET INFO DYNAMIC\_DNS Query to a \*.itafricagroup .com domain (info.rules) - 2065582 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.itafricagroup .com domain (info.rules) - 2065583 - ET WEB\_SPECIFIC\_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307) (web\_specific\_apps.rules) - 2065584 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (caddov .mom) (malware.rules) - 2065585 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (caddov .mom) in TLS SNI (malware.rules) - 2065586 - ET WEB\_SPECIFIC\_APPS IPFire time.cgi UPDATE\_VALUE Parameter Cross Site Scripting Attempt (CVE-2025-34308) (web\_specific\_apps.rules) - 2065587 - ET WEB\_SPECIFIC\_APPS IPFire ddns.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34309) (web\_specific\_apps.rules) - 2065588 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (fellsminjs .com) (exploit\_kit.rules) - 2065589 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (fellsminjs .com) (exploit\_kit.rules) - 2065590 - ET MALWARE TA569 Middleware Server Domain in DNS Lookup (bedenefuneralhome .com) (malware.rules) - 2065591 - ET MALWARE TA569 Middleware Server Domain in TLS SNI (bedenefuneralhome .com) (malware.rules) - 2065592 - ET WEB\_SPECIFIC\_APPS IPFire qos.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34310) (web\_specific\_apps.rules) - 2065593 - ET HUNTING WASM RWX Page Memory Allocation - Common Shellcode Precursor (hunting.rules) - 2065594 - ET WEB\_SPECIFIC\_APPS IPFire calamaris.dat Multiple Parameters Command Injection Attempt (CVE-2025-34311) (web\_specific\_apps.rules) - 2065595 - ET EXPLOIT Chrome V8 Shellcode Inject Attempt (exploit.rules) - 2065596 - ET WEB\_SPECIFIC\_APPS IPFire urlfilter.cgi BE\_NAME Parameter Command Injection Attempt (CVE-2025-34312) (web\_specific\_apps.rules) - 2065597 - ET MALWARE Observed DNS Query to Malicious Domain (redirect-workspace .com) (malware.rules) - 2065598 - ET MALWARE Observed DNS Query to Malicious Domain (docs-workspace .live) (malware.rules) - 2065599 - ET MALWARE Observed DNS Query to Malicious Domain (linkeedservice .com) (malware.rules) - 2065600 - ET MALWARE Observed DNS Query to Malicious Domain (form-space .org) (malware.rules) - 2065601 - ET MALWARE Observed Malicious Domain (redirect-workspace .com in TLS SNI) (malware.rules) - 2065602 - ET WEB\_SPECIFIC\_APPS IPFire urlfilter.cgi QUOTA\_USERS Parameter Cross Site Scripting Attempt (CVE-2025-34313) (web\_specific\_apps.rules) - 2065603 - ET MALWARE Observed Malicious Domain (docs-workspace .live in TLS SNI) (malware.rules) - 2065604 - ET MALWARE Observed Malicious Domain (linkeedservice .com in TLS SNI) (malware.rules) - 2065605 - ET MALWARE Observed Malicious Domain (form-space .org in TLS SNI) (malware.rules) - 2065606 - ET WEB\_SPECIFIC\_APPS IPFire urlfilter.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34314) (web\_specific\_apps.rules) - 2065607 - ET WEB\_SPECIFIC\_APPS IPFire config.dat REMOTELOG\_ADDR Parameter Cross Site Scripting Attempt (CVE-2025-34315) (web\_specific\_apps.rules) - 2065608 - ET WEB\_SPECIFIC\_APPS IPFire mail.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34316) (web\_specific\_apps.rules) - 2065609 - ET WEB\_SPECIFIC\_APPS IPFire dns.cgi TLS\_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317) (web\_specific\_apps.rules) - 2065610 - ET MALWARE TA398 Domain in DNS Lookup (intelupates .com) (malware.rules) - 2065611 - ET MALWARE TA398 Domain in TLS SNI (intelupates .com) (malware.rules) - 2065612 - ET WEB\_SPECIFIC\_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318) (web\_specific\_apps.rules) ### Pro: - 2865019 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2865020 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2865021 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2865022 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2865023 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD+ Outbound (malware.rules) - 2865024 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2865025 - ETPRO MALWARE Win32/XWorm V2 CnC Command - sendfileto Inbound (malware.rules) - 2865026 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2865027 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound (malware.rules) - 2865028 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2865029 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2865030 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Outbound (malware.rules) - 2865031 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2865032 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2865033 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2865034 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2865035 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2865036 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2865037 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2865038 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2865039 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2865040 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) - 2865041 - ETPRO MALWARE TA398 Domain in DNS Lookup (malware.rules) - 2865042 - ETPRO MALWARE TA398 Domain in TLS SNI (malware.rules) * * * ## Modified inactive rules: - 2001033 - ET ADWARE\_PUP Casino on Net Data Download (adware\_pup.rules) - 2002853 - ET DOS FreeBSD NFS RPC Kernel Panic (dos.rules) - 2003561 - ET MALWARE Bandook v1.35 Window List Reply (malware.rules) - 2003747 - ET WEB\_SPECIFIC\_APPS gnuedu Remote Inclusion Attempt – lom.php ETCDIR (web\_specific\_apps.rules) - 2007917 - ET MALWARE Dropper-497 (Yumato) Initial Checkin (malware.rules) - 2008608 - ET USER\_AGENTS WinFixer Trojan Related User-Agent (ElectroSun) (user\_agents.rules) - 2008681 - ET ADWARE\_PUP iframebiz - /qwertyuiyw12ertyuytre/adv\*\*\*.php (adware\_pup.rules) - 2009466 - ET WEB\_SPECIFIC\_APPS Recly Competitions Component add.php GLOBALS Parameter Remote File Inclusion (web\_specific\_apps.rules) - 2010267 - ET MALWARE Sinowal/Torpig Checkin (malware.rules) - 2012646 - ET MALWARE Malicious JAR olig (malware.rules) - 2013900 - ET MALWARE W32/Yaq Checkin (malware.rules) - 2014633 - ET WEB\_SPECIFIC\_APPS phpMyAdmin setup.php Remote File inclusion Attempt (CVE-2010-3055) (web\_specific\_apps.rules) - 2014950 - ET WEB\_SPECIFIC\_APPS Nagios XI div parameter Cross-Site Scripting Attempt (web\_specific\_apps.rules) - 2016717 - ET EXPLOIT\_KIT BHEK ff.php iframe inbound (exploit\_kit.rules) - 2017101 - ET EXPLOIT\_KIT /Styx EK - /jovf.html (exploit\_kit.rules) - 2017995 - ET EXPLOIT\_KIT GoonEK Landing Jan 21 2013 SilverLight 1 (exploit\_kit.rules) - 2018242 - ET MALWARE Possible Zeus GameOver Connectivity Check (malware.rules) - 2018874 - ET MALWARE Tor based locker .onion Proxy DNS lookup July 31 2014 (malware.rules) - 2019251 - ET WEB\_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 8 (web\_server.rules) - 2019555 - ET MALWARE Sofacy HTTP Request scanmalware.info (malware.rules) - 2019711 - ET MALWARE W32Autorun.worm.aaeh Checkin (malware.rules) - 2019712 - ET MALWARE W32/Keylogger.CI Checkin (malware.rules) - 2020049 - ET MALWARE TorrentLocker DNS Lookup ([it-newsblog.ru](http://it-newsblog.ru)) (malware.rules) - 2020735 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC) (malware.rules) - 2100394 - GPL ICMP\_INFO Destination Unreachable Destination Host Unknown (icmp\_info.rules) - 2102336 - GPL TFTP NULL command attempt (tftp.rules) - 2800134 - ETPRO EXPLOIT Trend Micro ServerProtect RPC RPCFN\_CMON\_SetSvcImpersonateUser Buffer Overflow 2 (exploit.rules) - 2801169 - ETPRO SCADA\_SPECIAL SCHWEITZER (Event 33) Date Change Attempt (scada\_special.rules) - 2801290 - ETPRO WORM Worm.Win32.Slenfbot.G Checkin 2 (worm.rules) - 2802109 - ETPRO EXPLOIT CA Total Defense Suite UNCWS getDBConfigSettings Credential Information Disclosure (exploit.rules) - 2803238 - ETPRO MALWARE Trojan.Win32.Agent.dhy Checkin (malware.rules) - 2803710 - ETPRO MALWARE Trojan-Downloader.Win32.Diple.A Checkin 2 (malware.rules) - 2804472 - ETPRO MALWARE Trojan.Crypt.Delf.AH Checkin (malware.rules) - 2804637 - ETPRO INFO DNS Query to a \*.coom .in Abused DNS Domain (info.rules) - 2805259 - ETPRO MALWARE Win32/Zegost.AD CnC Traffic 2 (malware.rules) - 2805398 - ETPRO MALWARE Trojan.Heur.hm0@fjz6PkS Checkin (malware.rules) - 2805717 - ETPRO WEB\_CLIENT Microsoft Internet Explorer CTreeNode Use After Free (web\_client.rules) - 2806001 - ETPRO MALWARE Win32/Tepv.A CnC Credentials Returned (malware.rules) - 2807934 - ETPRO WEB\_CLIENT Microsoft Internet Explorer Use After free (CVE-2014-1752) (web\_client.rules) - 2809869 - ETPRO MOBILE\_MALWARE Trojan-SMS.AndroidOS.FakeInst.ep Checkin (mobile\_malware.rules) - 2820577 - ETPRO MALWARE TorrentLocker DNS query to Domain \*.mybariton.com (malware.rules) - 2823450 - ETPRO MALWARE Malicious SSL Certificate Detected (Vawtrak CnC) (malware.rules) - 2825820 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Asacub.a Checkin 33 (mobile\_malware.rules)