# Daily Ruleset Update Summary 2022/11/01

**URL:** <https://community.emergingthreats.net/t/daily-ruleset-update-summary-2022-11-01/116>\
**Category:** Ruleset Updates\
**Created:** [November 1, 2022, 9:42pm UTC](https://community.emergingthreats.net/t/daily-ruleset-update-summary-2022-11-01/116 "2022-11-01T21:42:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\
**Post date:** [November 1, 2022, 9:42pm UTC](https://community.emergingthreats.net/t/daily-ruleset-update-summary-2022-11-01/116/1 "2022-11-01T21:42:06Z")

</div>

**Summary:**

9 new OPEN, 27 new PRO (9 + 18) SocGholish, Win32/Agent.AETZ CnC Checkin, and Various Adware and Phish

Please share issues, feedback, and requests at [Feedback](https://feedback.emergingthreats.net/feedback)

Thanks @Thingzeye

**Added rules:**

**Open:**

2039609 - ET PHISHING TMOBILE Credential Phish Landing Page 2022-11-01 (phishing.rules)  
2039610 - ET PHISHING TMOBILE Successful Credential Phish 2022-11-01 (phishing.rules)  
2039611 - ET ADWARE\_PUP DriverTurbo Domain (driverturbo .com) in DNS Lookup (adware\_pup.rules)  
2039612 - ET ADWARE\_PUP DriverTurbo Domain (driverfinderpro .com) in DNS Lookup (adware\_pup.rules)  
2039613 - ET ADWARE\_PUP DriverFinder User-Agent Observed in HTTP Traffic (adware\_pup.rules)  
2039614 - ET INFO Observed DNS Query to Dynamic DNS Service Domain (duia .ro) (info.rules)  
2039615 - ET INFO Observed Dynamic DNS Service Domain in TLS SNI (duia .ro) (info.rules)  
2039616 - ET MALWARE Win32/Agent.AETZ CnC Checkin (malware.rules)  
2039617 - ET MALWARE SocGholish Domain in DNS Lookup (squad .incumetrics .com) (malware.rules)

**Pro:**

2852749 - ETPRO PHISHING Successful Generic Phish 2022-11-01 (phishing.rules)

**Disabled and modified rules:**

2039603 - ET MALWARE JS/AlterSave Skimmer Payload Inbound M1 (malware.rules)  
2039604 - ET MALWARE JS/AlterSave Skimmer Payload Inbound M2 (malware.rules)
