# Ruleset Update Summary - 2023/02/07 - v10238 **URL:** \ **Category:** Ruleset Updates\ **Created:** [February 7, 2023, 9:43pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-02-07-v10238/301 "2023-02-07T21:43:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [February 7, 2023, 9:43pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-02-07-v10238/301/1 "2023-02-07T21:43:25Z")
## Summary: 5 new OPEN, 20 new PRO (5 + 15) The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net) We will announce the mailing list retirement date in the near future. * * * ## Added rules: ### Open: - 2044142 - ET PHISHING Possible Phishing Domain in DNS Lookup (c1 .biz) (phishing.rules) - 2044143 - ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M1 (exploit.rules) - 2044144 - ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M2 (exploit.rules) - 2044145 - ET EXPLOIT Fortra MFT Deserialization Remote Code Execution Attempt (CVE-2023-0669) M3 (exploit.rules) - 2044146 - ET MALWARE Win32/Disabler.NPR Checkin (malware.rules) ### Pro: - 2853334 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.i CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853335 - ETPRO MOBILE\_MALWARE Trojan-Ransom.AndroidOS.Aples.b CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853336 - ETPRO MOBILE\_MALWARE Trojan-Ransom.AndroidOS.Svpeng.ab Checkin (mobile\_malware.rules) - 2853337 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Piom.aujb CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853338 - ETPRO MOBILE\_MALWARE Observed Trojan.AndroidOS.Piom.aujb Domain in TLS SNI (mobile\_malware.rules) - 2853339 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Gigabud.a / Android/Spy.Agent.CNE Checkin via Websocket (mobile\_malware.rules) - 2853340 - ETPRO MOBILE\_MALWARE Trojan-Spy.AndroidOS.Gigabud.a / Android/Spy.Agent.CNE Checkin via Websocket 2 (mobile\_malware.rules) - 2853341 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CKR Checkin (mobile\_malware.rules) - 2853342 - ETPRO MOBILE\_MALWARE Android.BankBot.14071 / Hookbot Checkin (mobile\_malware.rules) - 2853343 - ETPRO MOBILE\_MALWARE Android.BankBot.14071 / Hookbot Checkin 2 (mobile\_malware.rules) - 2853344 - ETPRO MOBILE\_MALWARE Android.BankBot.14071 / Hookbot Checkin 3 (mobile\_malware.rules) - 2853345 - ETPRO MOBILE\_MALWARE Android/Agent.EHA CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853346 - ETPRO MOBILE\_MALWARE Android/Spy.Agent.CLW CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853347 - ETPRO PHISHING Successful TA407 Credential Phish 2023-02-07 (phishing.rules) - 2853348 - ETPRO MALWARE SocGholish CnC Initial Request M2 (malware.rules) * * * ## Disabled and modified rules: - 2852921 - ETPRO MALWARE WasabiSeed Downloader Activity (GET) (malware.rules)