# Ruleset Update Summary - 2025/11/12 - v11061 **URL:** \ **Category:** Ruleset Updates\ **Created:** [November 12, 2025, 9:37pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-12-v11061/3107 "2025-11-12T21:37:22Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [November 12, 2025, 9:37pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-12-v11061/3107/1 "2025-11-12T21:37:23Z")
## Summary: 23 new OPEN, 25 new PRO (23 + 2) Thanks @zscaler * * * ## Added rules: ### Open: - 2065732 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (hcm-technology .com) (malware.rules) - 2065733 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (microhosting .pro) (malware.rules) - 2065734 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (hcm-technology .com) (malware.rules) - 2065735 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (microhosting .pro) (malware.rules) - 2065736 - ET MALWARE PikaBot User-Agent Observed (malware.rules) - 2065737 - ET MALWARE ZLoader User-Agent Observed (malware.rules) - 2065738 - ET MALWARE ZLoader CnC Activity (POST) (malware.rules) - 2065739 - ET WEB\_SPECIFIC\_APPS Advantech R-SeeNet ping.php Command Injection (CVE-2021-21805) (web\_specific\_apps.rules) - 2065740 - ET WEB\_SPECIFIC\_APPS Arcserve Unified Data Protection wizardLogin Authentication Bypass (CVE-2024-0799) (web\_specific\_apps.rules) - 2065741 - ET WEB\_SPECIFIC\_APPS Arcserve Unified Data Protection Console Unauthenticated DoS in ASNative.dll (CVE-2024-0801) (web\_specific\_apps.rules) - 2065742 - ET WEB\_SPECIFIC\_APPS Citrix Netscaler SAML RelayState Reflected Cross-Site Scripting (CVE-2025-12101) (web\_specific\_apps.rules) - 2065743 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (frostshiledr .com) (exploit\_kit.rules) - 2065744 - ET EXPLOIT\_KIT ZPHP Domain in DNS Lookup (holonimjs .com) (exploit\_kit.rules) - 2065745 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (frostshiledr .com) (exploit\_kit.rules) - 2065746 - ET EXPLOIT\_KIT ZPHP Domain in TLS SNI (holonimjs .com) (exploit\_kit.rules) - 2065747 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (benefits .cheapguys .com) (malware.rules) - 2065748 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (prototype .tapmycard .work) (malware.rules) - 2065749 - ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (register .toastmasters86 .org) (malware.rules) - 2065750 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (benefits .cheapguys .com) (malware.rules) - 2065751 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (prototype .tapmycard .work) (malware.rules) - 2065752 - ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (register .toastmasters86 .org) (malware.rules) - 2065753 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (reechel .com) (exploit\_kit.rules) - 2065754 - ET EXPLOIT\_KIT LandUpdate808 Domain in TLS SNI (reechel .com) (exploit\_kit.rules) ### Pro: - 2865166 - ETPRO HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate (hunting.rules) - 2865167 - ETPRO MALWARE Malicious Win32/NetSupport Rat CnC Checkin (malware.rules) * * * ## Modified inactive rules: - 2002302 - ET ADWARE\_PUP [Searchfeed.com](http://Searchfeed.com) Spyware 7 (adware\_pup.rules) - 2003218 - ET ADWARE\_PUP Conduit Connect Toolbar Message Download(Many report to be benign) (adware\_pup.rules) - 2010492 - ET DOS Possible MYSQL SELECT WHERE to User Variable Denial Of Service Attempt (dos.rules) - 2013405 - ET ADWARE\_PUP W32/Baigoo User Agent (adware\_pup.rules) - 2014638 - ET MALWARE Maljava Dropper for OS X (malware.rules) - 2015678 - ET EXPLOIT\_KIT Sakura exploit kit exploit download request /view.php (exploit\_kit.rules) - 2018727 - ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2) (malware.rules) - 2019262 - ET WEB\_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 19 (web\_server.rules) - 2019563 - ET MALWARE Sofacy HTTP Request [checkmalware.org](http://checkmalware.org) (malware.rules) - 2019720 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC) (malware.rules) - 2020060 - ET MALWARE TorrentLocker DNS Lookup ([tweeter-stat.ru](http://tweeter-stat.ru)) (malware.rules) - 2020325 - ET EXPLOIT CVE-2015-0235 Exim Buffer Overflow Attempt (HELO) (exploit.rules) - 2020744 - ET EXPLOIT\_KIT HanJuan EK Landing March 24 2015 M2 (exploit\_kit.rules) - 2020960 - ET MALWARE Possible Graftor Downloading Dridex (malware.rules) - 2022277 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM) (malware.rules) - 2022446 - ET MALWARE Scarlet Mimic DNS Lookup 36 (malware.rules) - 2022676 - ET MALWARE Ransomware/Coverton Checkin (malware.rules) - 2022768 - ET MALWARE Retefe Banker .onion Domain (malware.rules) - 2023322 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM) (malware.rules) - 2100270 - GPL MISC Teardrop attack (misc.rules) - 2102951 - GPL NETBIOS SMB-DS too many stacked requests (netbios.rules) - 2804757 - ETPRO ADWARE\_PUP Adware/Kikin.A Checkin (adware\_pup.rules) - 2804976 - ETPRO MALWARE Trojan.Win32.Diple.deyt Checkin (malware.rules) - 2805096 - ETPRO MALWARE Downloader.Win32.Knigsfot.ev Download Request (malware.rules) - 2805264 - ETPRO MALWARE Trojan.Win32.S.Banker.167310 Checkin (malware.rules) - 2805557 - ETPRO MALWARE Trojan.Generic.KD.697281 Checkin (malware.rules) - 2807800 - ETPRO WEB\_CLIENT Microsoft Internet Explorer Use After free (CVE-2014-0297) (web\_client.rules) - 2809006 - ETPRO MALWARE BackDoor.Tishop.2 Checkin (malware.rules) - 2819674 - ETPRO MOBILE\_MALWARE Android Trojan Unknown Checkin (mobile\_malware.rules) - 2820383 - ETPRO MALWARE Hawkeye Keylogger SMTP Stolen Credentials (malware.rules) - 2826028 - ETPRO MALWARE Malicious SSL Certificate Observed (Win32/Kryptik.FRIW Banker Injects) (malware.rules) * * * ## Disabled and modified rules: - 2044604 - ET MALWARE Observed DNS Query to LIGHTSHOW Domain (fainstec .com) (malware.rules)