# Ruleset Update Summary - 2025/11/27 - v11072

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-27-v11072/3121>\
**Category:** Ruleset Updates\
**Created:** [November 27, 2025, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-27-v11072/3121 "2025-11-27T20:49:04Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 27, 2025, 8:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2025-11-27-v11072/3121/1 "2025-11-27T20:49:05Z")

</div>

## Summary:

4 new OPEN, 5 new PRO (4 + 1)

* * *

## Added rules:

### Open:

- 2065932 - ET EXPLOIT\_KIT LandUpdate808 Domain in DNS Lookup (yorkci .com) (exploit\_kit.rules)
- 2065933 - ET EXPLOIT\_KIT LandUpdate808 Domain (yorkci .com) in TLS SNI (exploit\_kit.rules)
- 2065934 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sirrbef .cyou) (malware.rules)
- 2065935 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sirrbef .cyou) in TLS SNI (malware.rules)

### Pro:

- 2865234 - ETPRO MALWARE Win32/zgRAT CnC Checkin (malware.rules)

* * *

## Modified inactive rules:

- 2001262 - ET CHAT Yahoo IM conference offer invitation (chat.rules)
- 2009976 - ET EXPLOIT Siemens Gigaset SE361 WLAN Data Flood Denial of Service Vulnerability (exploit.rules)
- 2016995 - ET MALWARE Connection to 1&1 Sinkhole IP (Possible Infected Host) (malware.rules)
- 2017473 - ET EXPLOIT\_KIT Possible CoolEK Variant Payload Download Sep 16 2013 (exploit\_kit.rules)
- 2017625 - ET CURRENT\_EVENTS 81a338 Hacked Site Response (Outbound) (current\_events.rules)
- 2018737 - ET EXPLOIT\_KIT Fake CDN Sweet Orange Gate July 17 2014 (exploit\_kit.rules)
- 2019271 - ET WEB\_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 28 (web\_server.rules)
- 2019724 - ET EXPLOIT\_KIT Archie EK Flash Exploit URI Struct Nov 17 2014 (exploit\_kit.rules)
- 2020187 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC) (malware.rules)
- 2020888 - ET INFO invalid.cab domain in SNI (info.rules)
- 2021777 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM) (malware.rules)
- 2021925 - ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM) (malware.rules)
- 2065929 - ET WEB\_SPECIFIC\_APPS Grafana Open Redirect (CVE-2025-4123) M1 (web\_specific\_apps.rules)
- 2803105 - ETPRO DNS ISC BIND RRSIG RRsets Denial of Service UDP 1 (dns.rules)
- 2805103 - ETPRO MALWARE Trojan.Win32.Vilsel.blgz .exe file download (malware.rules)
- 2805274 - ETPRO MALWARE Trojan/Banker.Banbra.oyx Checkin (malware.rules)
- 2805407 - ETPRO ADWARE\_PUP Adware/SnapDo Install (adware\_pup.rules)
- 2805725 - ETPRO MALWARE Win32/Small.gen!M gif check (malware.rules)
- 2805905 - ETPRO MALWARE Hupigon Checkin to ip.txt Received (malware.rules)
- 2807666 - ETPRO MALWARE Virus.Win32.Virut.ce Checkin 5 (malware.rules)
- 2809787 - ETPRO MALWARE MSIL/INJECTOR.HMT Checkin (malware.rules)
- 2816774 - ETPRO MOBILE\_MALWARE Android/HiddenApp.K Checkin (mobile\_malware.rules)
- 2819952 - ETPRO MALWARE Ransomware/TrueCrypter Onion Domain Lookup (malware.rules)
- 2820593 - ETPRO MALWARE Zeus Panda Banker Malicious SSL Certificate Detected (malware.rules)