# Ruleset Update Summary - 2025/11/07 - v11058 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 7, 2025, 9:21pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-07-v11058/3104 "2025-11-07T21:21:44Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 7, 2025, 9:21pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-07-v11058/3104/1 "2025-11-07T21:21:44Z")
## Summary: 8 new OPEN, 44 new PRO (8 + 36) * * * ## Added rules: ### Open: - 2065694 - ET WEB\_SPECIFIC\_APPS Monsta FTP Server Side Request Forgery Attempt (CVE-2022-31827) (web\_specific\_apps.rules) - 2065695 - ET WEB\_SPECIFIC\_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299) (web\_specific\_apps.rules) - 2065696 - ET MALWARE LeakyStealer CnC Checkin (malware.rules) - 2065697 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (virtvan .com) (exploit\_kit.rules) - 2065698 - ET EXPLOIT\_KIT LandUpdate808 Domain (virtvan .com) in TLS SNI (exploit\_kit.rules) - 2065699 - ET WEB\_SPECIFIC\_APPS Django Authentication Bypass via SQLi (CVE-2025-64459) (web\_specific\_apps.rules) - 2065700 - ET WEB\_SPECIFIC\_APPS Django Data Exfiltration via SQLi (CVE-2025-64459) (web\_specific\_apps.rules) - 2065701 - ET WEB\_SPECIFIC\_APPS Django Privilege Escalation via SQLi (CVE-2025-64459) (web\_specific\_apps.rules) ### Pro: - 2865093 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865094 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865095 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865096 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865097 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865098 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865099 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865100 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865101 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865102 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865103 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865104 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865105 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865106 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865107 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865108 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865109 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865110 - ETPRO MALWARE UNK\_BlackGold Domain in DNS Lookup (malware.rules) - 2865111 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865112 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865113 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865114 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865115 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865116 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865117 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865118 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865119 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865120 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865121 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865122 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865123 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865124 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865125 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865126 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865127 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) - 2865128 - ETPRO MALWARE Observed UNK\_BlackGold Domain in TLS SNI (malware.rules) * * * ## Modified inactive rules: - 2001658 - ET ADWARE\_PUP Comet Systems Spyware Reporting (adware\_pup.rules) - 2002298 - ET ADWARE\_PUP [Searchfeed.com](http://Searchfeed.com) Spyware 3 (adware\_pup.rules) - 2003085 - ET WEB\_SPECIFIC\_APPS TWiki Configure Script TYPEOF Remote Command Execution Attempt (web\_specific\_apps.rules) - 2008289 - ET CHAT Possible MSN Messenger File Transfer (chat.rules) - 2008485 - ET ADWARE\_PUP Searchtool.co.kr Fake Product User-Agent (searchtoolup) (adware\_pup.rules) - 2012231 - ET ACTIVEX Oracle Document Capture Insecure Read Method File Access Attempt (activex.rules) - 2017467 - ET EXPLOIT\_KIT CottonCastle EK Java Jar (exploit\_kit.rules) - 2017758 - ET EXPLOIT\_KIT Possible Java Lang Runtime in B64 Observed in Goon EK 2 (exploit\_kit.rules) - 2018117 - ET MALWARE Possible Sinkhole banner (malware.rules) - 2018723 - ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2) (malware.rules) - 2019258 - ET WEB\_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 15 (web\_server.rules) - 2019559 - ET MALWARE Sofacy HTTP Request [testsnetcontrol.com](http://testsnetcontrol.com) (malware.rules) - 2019717 - ET MALWARE Alureon Checkin (malware.rules) - 2019892 - ET EXPLOIT\_KIT Malicious Iframe Leading to EK Dec 08 2014 (exploit\_kit.rules) - 2020056 - ET MALWARE TorrentLocker DNS Lookup ([royalgourp.org](http://royalgourp.org)) (malware.rules) - 2020566 - ET MALWARE Netwire RAT Client HeartBeat (malware.rules) - 2021054 - ET EXPLOIT\_KIT Magnitude EK Flash Payload ShellCode Apr 23 2015 (exploit\_kit.rules) - 2021429 - ET MALWARE Possible IE MSMXL Detection of Local DLL (Likely Malicious) (malware.rules) - 2021732 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC) (malware.rules) - 2022067 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (ProxyChanger) (malware.rules) - 2022221 - ET WEB\_CLIENT Facebook password stealing inject Jan 04 (web\_client.rules) - 2022442 - ET MALWARE Scarlet Mimic DNS Lookup 32 (malware.rules) - 2022764 - ET MALWARE Retefe Banker .onion Domain (malware.rules) - 2806214 - ETPRO EXPLOIT MongoDB nativeHelper.apply Remote Code Execution (CVE-2013-1892) (exploit.rules) - 2810729 - ETPRO MALWARE Trojan-Downloader.Banload Connectivity Check Form1 (malware.rules) - 2811061 - ETPRO MALWARE Win32/Spy.POSCardStealer.C FTP STOR Command (malware.rules) - 2812538 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Fakeapp.a Checkin (mobile\_malware.rules) - 2819670 - ETPRO MALWARE Unknown Keylogger Checkin (malware.rules) - 2820379 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Guerrilla.g Checkin (mobile\_malware.rules) - 2820583 - ETPRO MALWARE TorrentLocker DNS query to Domain pahrently.biz (malware.rules) - 2823245 - ETPRO MALWARE Observed Malicious Ransomware Domain SSL Cert in SNI (Hidden-Tear Variant) (malware.rules)