# Ruleset Update Summary - 2022/11/24 - v10181

**URL:** <https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-24-v10181/176>\
**Category:** Ruleset Updates\
**Created:** [November 24, 2022, 8:22pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-24-v10181/176 "2022-11-24T20:22:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\
**Post date:** [November 24, 2022, 8:22pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2022-11-24-v10181/176/1 "2022-11-24T20:22:01Z")

</div>

## Summary:

0 new OPEN, 27 new PRO (0 + 27)

The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net)

We will announce the mailing list retirement date in the near future.

* * *

## Added rules:

### Pro:

- 2852858 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CKR CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852859 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852860 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852861 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852862 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Agent.aac Checkin (mobile\_malware.rules)
- 2852863 - ETPRO MOBILE\_MALWARE Observed Android/Agent.EAT Domain in TLS SNI (mobile\_malware.rules)
- 2852864 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CKR CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852865 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.e CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852866 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.BSA Checkin (mobile\_malware.rules)
- 2852867 - ETPRO MOBILE\_MALWARE Backdoor.AndroidOS.Xhunter.a CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852868 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Realrat.a CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852869 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CKR CnC Domain in DNS Lookup (mobile\_malware.rules)
- 2852870 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (malware.rules)
- 2852871 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M1 (malware.rules)
- 2852872 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M1 (malware.rules)
- 2852873 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 (malware.rules)
- 2852874 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 (malware.rules)
- 2852875 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M3 (malware.rules)
- 2852876 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M3 (malware.rules)
- 2852877 - ETPRO MALWARE Observed Malicious SSL/TLS Certificate (LunarReborn C2) (malware.rules)
- 2852878 - ETPRO MALWARE LunarReborn CnC Checkin (malware.rules)
- 2852879 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M1 (exploit.rules)
- 2852880 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M2 (exploit.rules)
- 2852881 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M3 (exploit.rules)
- 2852882 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M4 (exploit.rules)
- 2852883 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M5 (exploit.rules)
- 2852884 - ETPRO EXPLOIT Possible Encoded Stored XSS Delivered via SMTP Filename Observed M6 (exploit.rules)

* * *

## Modified active rules:

- 2852710 - ETPRO MOBILE\_MALWARE Android/Simplocker.B Checkin 2 (mobile\_malware.rules)

* * *

## Removed rules:

- 2852487 - ETPRO MALWARE Win32/XWorm CnC Command (PING?) (malware.rules)
- 2852488 - ETPRO MALWARE Win32/XWorm CnC Command (PING!) (malware.rules)
- 2852489 - ETPRO MALWARE Win32/XWorm CnC Command (DDosS) (malware.rules)
- 2852490 - ETPRO MALWARE Win32/XWorm CnC Command (DDosT) (malware.rules)
- 2852491 - ETPRO MALWARE Win32/XWorm CnC Command (Cilpper) (malware.rules)
- 2852492 - ETPRO MALWARE Win32/XWorm CnC Command (hidefolderfile) (malware.rules)
- 2852493 - ETPRO MALWARE Win32/XWorm CnC Command (showfolderfile) (malware.rules)
- 2852494 - ETPRO MALWARE Win32/XWorm CnC Command (creatnewfolder) (malware.rules)
- 2852495 - ETPRO MALWARE Win32/XWorm CnC Command (creatfile) (malware.rules)
- 2852496 - ETPRO MALWARE Win32/XWorm CnC Command (downloadfile) (malware.rules)
- 2852497 - ETPRO MALWARE Win32/XWorm CnC Command (sendfileto) (malware.rules)
- 2852498 - ETPRO MALWARE Win32/XWorm CnC Command (DW) (malware.rules)
- 2852499 - ETPRO MALWARE Win32/XWorm CnC Command (RD-) (malware.rules)
- 2852500 - ETPRO MALWARE Win32/XWorm CnC Command (RD+) (malware.rules)
- 2852501 - ETPRO MALWARE Win32/XWorm CnC Command (###) (malware.rules)
- 2852502 - ETPRO MALWARE Win32/XWorm CnC Command ($$$) (malware.rules)
- 2852503 - ETPRO MALWARE Win32/XWorm CnC Command (^^^g) (malware.rules)
- 2852504 - ETPRO MALWARE Win32/XWorm CnC Command (ENC) (malware.rules)
- 2852505 - ETPRO MALWARE Win32/XWorm CnC Command (HVNC) (malware.rules)
- 2852847 - ETPRO MALWARE XWorm Short C&C Request (flowbit set) (malware.rules)
- 2852849 - ETPRO MALWARE Win32/XWorm CnC Command (rec) (malware.rules)
- 2852850 - ETPRO MALWARE Win32/XWorm CnC Command (CLOSE) (malware.rules)
- 2852851 - ETPRO MALWARE Win32/XWorm CnC Command (uninstall) (malware.rules)
- 2852852 - ETPRO MALWARE Win32/XWorm CnC Command (getinfo) M1 (malware.rules)
- 2852853 - ETPRO MALWARE Win32/XWorm CnC Command (getinfo) M2 (malware.rules)
- 2852854 - ETPRO MALWARE Win32/XWorm CnC Command (openhide) (malware.rules)
- 2852855 - ETPRO MALWARE Win32/XWorm CnC Command (shellfuc) (malware.rules)