# Ruleset Update Summary - 2025/11/06 - v11057 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 6, 2025, 10:04pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-06-v11057/3103 "2025-11-06T22:04:02Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 6, 2025, 10:04pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-06-v11057/3103/1 "2025-11-06T22:04:02Z")
## Summary: 16 new OPEN, 33 new PRO (16 + 17) * * * ## Added rules: ### Open: - 2065678 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (dolmain .com) (exploit\_kit.rules) - 2065679 - ET EXPLOIT\_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI (exploit\_kit.rules) - 2065680 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (edentista .com) (exploit\_kit.rules) - 2065681 - ET EXPLOIT\_KIT LandUpdate808 Domain (edentista .com) in TLS SNI (exploit\_kit.rules) - 2065682 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (saeam .com) (exploit\_kit.rules) - 2065683 - ET EXPLOIT\_KIT LandUpdate808 Domain (saeam .com) in TLS SNI (exploit\_kit.rules) - 2065684 - ET WEB\_SPECIFIC\_APPS Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-3066) (web\_specific\_apps.rules) - 2065685 - ET WEB\_SPECIFIC\_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833) (web\_specific\_apps.rules) - 2065686 - ET EXPLOIT Adobe ColdFusion ODBC Agent Memory Corruption (CVE-2022-35690) (exploit.rules) - 2065687 - ET WEB\_SPECIFIC\_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300) (web\_specific\_apps.rules) - 2065688 - ET WEB\_SPECIFIC\_APPS Adobe ColdFusion Access Control Bypass (CVE-2023-38205) (web\_specific\_apps.rules) - 2065689 - ET PHISHING Observed DNS Query to Phishing Domain (processserverscleveland .com) (phishing.rules) - 2065690 - ET EXPLOIT 7-Zip 7z File PPMd Properties Parsing Integer Underflow (CVE-2023-31102) (exploit.rules) - 2065691 - ET PHISHING Observed Phishing Domain (processserverscleveland .com in TLS SNI) (phishing.rules) - 2065692 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com) (malware.rules) - 2065693 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com) (malware.rules) ### Pro: - 2865076 - ETPRO WEB\_SPECIFIC\_APPS 3CX Phone System VAD\_Deploy.aspx Arbitrary File Upload (web\_specific\_apps.rules) - 2865077 - ETPRO MALWARE Win32/XWorm V2 CnC Command - PING Outbound (malware.rules) - 2865078 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound (malware.rules) - 2865079 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound (malware.rules) - 2865080 - ETPRO MALWARE Win32/XWorm V2 CnC Command - RD- Inbound (malware.rules) - 2865081 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound (malware.rules) - 2865082 - ETPRO MALWARE Win32/XWorm V3 CnC Command - Informations Outbound (malware.rules) - 2865083 - ETPRO MALWARE Win32/XWorm V3 CnC Command - GetInformations Inbound (malware.rules) - 2865084 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PCShutdown Inbound (malware.rules) - 2865085 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M3 (hunting.rules) - 2865086 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M4 (hunting.rules) - 2865087 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M5 (hunting.rules) - 2865088 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M6 (hunting.rules) - 2865089 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M7 (hunting.rules) - 2865090 - ETPRO MALWARE pngMoonWalk CnC Activity (POST) (malware.rules) - 2865091 - ETPRO MALWARE Observed DNS Query to pngMoonwalk Domain (malware.rules) - 2865092 - ETPRO MALWARE Observed pngMoonwalk Domain in TLS SNI (malware.rules) * * * ## Modified inactive rules: - 2001655 - ET ADWARE\_PUP Comet Systems Spyware Traffic (context.xml) (adware\_pup.rules) - 2002297 - ET ADWARE\_PUP [Searchfeed.com](http://Searchfeed.com) Spyware 2 (adware\_pup.rules) - 2002662 - ET WEB\_SPECIFIC\_APPS TWiki INCLUDE remote command execution attempt (web\_specific\_apps.rules) - 2002914 - ET EXPLOIT VNC Server VNC Auth Offer (exploit.rules) - 2003236 - ET DOS NetrWkstaUserEnum Request with large Preferred Max Len (dos.rules) - 2008484 - ET ADWARE\_PUP Cleancop.co.kr Fake AV User-Agent (CleancopUpdate) (adware\_pup.rules) - 2012391 - ET MALWARE Tatanga Checkin (malware.rules) - 2016035 - ET CURRENT\_EVENTS Possible SibHost PDF Request (current\_events.rules) - 2021731 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC) (malware.rules) - 2022066 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (ProxyChanger) (malware.rules) - 2022441 - ET MALWARE Scarlet Mimic DNS Lookup 31 (malware.rules) - 2100401 - GPL ICMP\_INFO Destination Unreachable Network Unreachable (icmp\_info.rules) - 2101437 - GPL POLICY Windows Media download (policy.rules) - 2800141 - ETPRO EXPLOIT RealNetworks Helix DNA Server RTSP Service Heap Overflow (exploit.rules) - 2800396 - ETPRO CHAT Cerulean Studios Trillian Image Filename XML Tag Stack Buffer Overflow (chat.rules) - 2800705 - ETPRO EXPLOIT Microsoft Outlook iCal Meeting Request Malformed VEVENT Record Dereference Memory Corruption (exploit.rules) - 2800859 - ETPRO EXPLOIT HP Data Protector Media Operations Null Pointer Deference Denial of Service Request (exploit.rules) - 2800961 - ETPRO EXPLOIT HP Data Protector OmniInet Service NULL Dereference Denial of Service (exploit.rules) - 2802885 - ETPRO MALWARE Trojan.Win32.Dcbavict.A Checkin 1 (malware.rules) - 2803875 - ETPRO MALWARE Win32/Agent.KA Checkin (malware.rules) - 2804313 - ETPRO MALWARE Trojan-Dropper.Win32.Agent.exc Checkin (malware.rules) - 2804478 - ETPRO MALWARE W32/Autorun.worm.bbs Install (malware.rules) - 2804753 - ETPRO MALWARE Win32/Wadolin.A Checkin (malware.rules) - 2805404 - ETPRO MALWARE Linux/Wirenet keep-alive outbound (malware.rules) - 2810728 - ETPRO MOBILE\_MALWARE Android/SMSreg.AV Checkin 2 (mobile\_malware.rules) - 2815593 - ETPRO MALWARE Win32.Rifdoor Checkin (malware.rules) - 2816183 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.hf Checkin (mobile\_malware.rules) - 2819669 - ETPRO MALWARE Unknown Ransomware Checkin (malware.rules) - 2823244 - ETPRO MALWARE Observed Malicious Ransomware Domain SSL Cert in SNI (Hidden-Tear Variant) (malware.rules)