# Ruleset Update Summary - 2022/12/19 - v10199

**URL:** https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-19-v10199/212
**Category:** Ruleset Updates
**Created:** [December 19, 2022, 9:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-19-v10199/212 "2022-12-19T21:53:59Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)
#### Post date: [December 19, 2022, 9:53pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2022-12-19-v10199/212/1 "2022-12-19T21:53:59Z")

</div>

## Summary:

10 new OPEN, 12 new PRO (10 + 2)

Thanks @ecarlesi, @James_inthe_box

The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net)

We will announce the mailing list retirement date in the near future.

* * *

## Added rules:

### Open:

- 2042959 - ET MALWARE TrueBot/Silence.Downloader CnC Checkin 3 (malware.rules)
- 2042960 - ET MALWARE TA444 Related Domain in DNS Lookup (cloudprotect .us .org) (malware.rules)
- 2042961 - ET MALWARE TA444 Related Domain in DNS Lookup (cloud .prosec .ink) (malware.rules)
- 2042962 - ET MALWARE Win32/Phoenix Grabber Sending System Information (POST) (malware.rules)
- 2042963 - ET PHISHING Suncoast Credit Union Credential Phish Landing Page 2022-12-19 (phishing.rules)
- 2042964 - ET PHISHING Possible DarkX Credential Phishing Landing Page 2022-12-19 (phishing.rules)
- 2042965 - ET PHISHING Successful DarkX Credential Phish 2022-12-19 (phishing.rules)
- 2042966 - ET MALWARE TA453 Related Domain in DNS Lookup (universityofmhealth .biz) (malware.rules)
- 2042967 - ET PHISHING Successful o365 Credential Phish 2022-12-19 (phishing.rules)
- 2042968 - ET MALWARE SocGholish Domain in DNS Lookup (navyseal .bezmail .com) (malware.rules)

### Pro:

- 2852957 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2022-12-14 1) (coinminer.rules)
- 2852960 - ETPRO MALWARE Sylavriu.A/TorCT RAT CnC Checkin M2 (malware.rules)

* * *

## Modified active rules:

- 2816110 - ETPRO MALWARE Sylavriu.A/TorCT RAT CnC Checkin M1 (malware.rules)
- 2852803 - ETPRO PHISHING Twitter Credential Phish Landing Page 2022-11-04 (phishing.rules)
- 2852953 - ETPRO MALWARE Qbot Style Payload Request (malware.rules)

* * *

## Disabled and modified rules:

- 2038948 - ET MALWARE SocGholish Domain in DNS Lookup (casting .faeryfox .com) (malware.rules)
- 2039780 - ET MALWARE SocGholish Domain in DNS Lookup (community .backpacktrader .com) (malware.rules)
- 2039781 - ET MALWARE TA569 Domain in DNS Lookup (friscomusicgroup .com) (malware.rules)
- 2039788 - ET MALWARE SocGholish Domain in DNS Lookup (casting .austinonline .shop) (malware.rules)
- 2039792 - ET MALWARE SocGholish CnC Domain in DNS Lookup (diary .lojjh .com) (malware.rules)
- 2039798 - ET MALWARE SocGholish Domain in DNS Lookup (factors .djbel .com) (malware.rules)

* * *

## Removed rules:

- 2834446 - ETPRO MALWARE TrueBot/Silence.Downloader CnC Checkin 3 (malware.rules)
- 2851990 - ETPRO MALWARE TA453 Related Domain in DNS Lookup (malware.rules)