# Ruleset Update Summary - 2023/01/31 - v10233 **URL:** \ **Category:** Ruleset Updates\ **Created:** [January 31, 2023, 11:15pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-01-31-v10233/294 "2023-01-31T23:15:26Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [January 31, 2023, 11:15pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-01-31-v10233/294/1 "2023-01-31T23:15:26Z")
## Summary: 14 new OPEN, 18 new PRO (14 + 4) Thanks @SLASH30Miata, @NoahWolf, @jaydinbas The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net) We will announce the mailing list retirement date in the near future. * * * ## Added rules: ### Open: - 2044031 - ET MALWARE GCleaner CnC Checkin M1 (malware.rules) - 2044032 - ET MALWARE GCleaner Payload Retrieval Attempt (malware.rules) - 2044033 - ET MALWARE GCleaner CnC Checkin M2 (malware.rules) - 2044034 - ET MALWARE Potential GCleaner CnC Checkin (malware.rules) - 2044035 - ET ADWARE\_PUP Win32/VoipRaider Data Collection Attempt (adware\_pup.rules) - 2044036 - ET PHISHING Successful VyStar CU Credential Phish 2023-01-31 (phishing.rules) - 2044037 - ET MALWARE GCleaner Downloader - Payload Response (malware.rules) - 2044038 - ET ADWARE\_PUP BoostBeast Task Request M1 (adware\_pup.rules) - 2044039 - ET ADWARE\_PUP BoostBeast Task Request M2 (adware\_pup.rules) - 2044040 - ET ADWARE\_PUP BoostBeast Checkin M1 (adware\_pup.rules) - 2044041 - ET ADWARE\_PUP BoostBeast Checkin M2 (adware\_pup.rules) - 2044042 - ET ADWARE\_PUP BoostBeast Task Response (adware\_pup.rules) - 2044043 - ET INFO Observed Notion Notes Taking App Domain (api .notion .com in TLS SNI) (info.rules) - 2044044 - ET MALWARE Suspected Lazarus APT Related Activity (GET) (malware.rules) ### Pro: - 2853266 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.SmsThief.td CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853267 - ETPRO COINMINER CoinMiner Known Malicious Stratum Authline (2023-01-30 1) (coinminer.rules) - 2853268 - ETPRO MALWARE Suspected VBS/Backdoor Activity (GET) (malware.rules) - 2853269 - ETPRO MALWARE Suspected VBS/Backdoor Activity (POST) (malware.rules) * * * ## Removed rules: - 2852925 - ETPRO MALWARE GCleaner Downloader - Payload Response (malware.rules)