# Ruleset Update Summary - 2023/01/30 - v10232 **URL:** \ **Category:** Ruleset Updates\ **Created:** [January 30, 2023, 10:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-01-30-v10232/292 "2023-01-30T22:34:27Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [January 30, 2023, 10:34pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-01-30-v10232/292/1 "2023-01-30T22:34:27Z")
## Summary: 17 new OPEN, 32 new PRO (17 + 15) Thanks @h2jazi, @k3yp0d The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net) We will announce the mailing list retirement date in the near future. * * * ## Added rules: ### Open: - 2044014 - ET INFO DYNAMIC\_DNS Query to a \*.dickeyfam .com domain (info.rules) - 2044015 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.dickeyfam .com domain (info.rules) - 2044016 - ET INFO DYNAMIC\_DNS Query to a \*.trudireaume .com domain (info.rules) - 2044017 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.trudireaume .com domain (info.rules) - 2044018 - ET INFO DYNAMIC\_DNS Query to a \*.tribeoftwo .com domain (info.rules) - 2044019 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.tribeoftwo .com domain (info.rules) - 2044020 - ET INFO DYNAMIC\_DNS Query to a \*.gun .vn domain (info.rules) - 2044021 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.gun .vn domain (info.rules) - 2044022 - ET MALWARE Observed APT Actor Payload Domain (archive-downloader .com in TLS SNI) (malware.rules) - 2044023 - ET MALWARE Observed APT Actor Payload Domain (e-aks .uz in TLS SNI) (malware.rules) - 2044024 - ET INFO Request for PDF via PowerShell (info.rules) - 2044025 - ET MALWARE ConnectWise ScreenConnect Payload Delivery Domain (win02 .xyz) in DNS Lookup (malware.rules) - 2044026 - ET MALWARE ConnectWise ScreenConnect Payload Delivery Domain (win03 .xyz) in DNS Lookup (malware.rules) - 2044027 - ET MALWARE ConnectWise ScreenConnect Payload Delivery Domain (win04 .xyz) in DNS Lookup (malware.rules) - 2044028 - ET MALWARE ConnectWise ScreenConnect Payload Delivery Domain (win01 .xyz) in DNS Lookup (malware.rules) - 2044029 - ET PHISHING Successful AU myGov Credential Phish 2023-01-30 (phishing.rules) - 2044030 - ET MALWARE SocGholish Domain in DNS Lookup (smiles .cahl4u .org) (malware.rules) ### Pro: - 2853251 - ETPRO MOBILE\_MALWARE Trojan-Ransom.AndroidOS.Small.ce CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853252 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CMX CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853253 - ETPRO MOBILE\_MALWARE Android/Spy.Banker.BSH CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853254 - ETPRO MOBILE\_MALWARE Android.Joker.929 CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853255 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Boogr.gsh CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853256 - ETPRO MOBILE\_MALWARE Android/TrojanSMS.Agent.DWK CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853257 - ETPRO MOBILE\_MALWARE Android.Joker.780 CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853258 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Piom.atin CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853259 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Agent.lc CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853260 - ETPRO MOBILE\_MALWARE Android/Spy.SmsSpy.YF CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853261 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.h CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853262 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.ew CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853263 - ETPRO MOBILE\_MALWARE Trojan-Ransom.AndroidOS.Soobek.a CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853264 - ETPRO HUNTING Logo Request via Iconfinder from HTA (hunting.rules) - 2853265 - ETPRO MALWARE APT Actor HTA Payload (malware.rules)