# Ruleset Update Summary - 2023/03/01 - v10256 **URL:** \ **Category:** Ruleset Updates\ **Created:** [March 1, 2023, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-03-01-v10256/340 "2023-03-01T21:49:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rulesbot](https://avatars.discourse-cdn.com/v4/letter/r/13edae/32.png) [@rulesbot](https://community.emergingthreats.net/u/rulesbot)\ **Post date:** [March 1, 2023, 9:49pm UTC](https://community.emergingthreats.net/t/ruleset-update-summary-2023-03-01-v10256/340/1 "2023-03-01T21:49:25Z")
## Summary: 9 new OPEN, 18 new PRO (9 + 9) Thanks @ESETresearch The Emerging Threats mailing list is migrating to Discourse. Please visit us at [https://community.emergingthreats.net](https://community.emergingthreats.net) The mailing list is being retired on April 3, 2023. Due to an internal company holiday there will be no rule release on Friday March 3rd, 2023. * * * ## Added rules: ### Open: - 2044412 - ET INFO DYNAMIC\_DNS Query to a \*.neisa .com Domain (info.rules) - 2044413 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.neisa .com Domain (info.rules) - 2044414 - ET INFO DYNAMIC\_DNS Query to a \*.with .mirkforce .de Domain (info.rules) - 2044415 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.with .mirkforce .de Domain (info.rules) - 2044416 - ET INFO DYNAMIC\_DNS Query to a \*.visite .es Domain (info.rules) - 2044417 - ET INFO DYNAMIC\_DNS HTTP Request to a \*.visite .es Domain (info.rules) - 2044418 - ET MALWARE Observed BlackLotus SSL Certificate Observed (malware.rules) - 2044419 - ET MALWARE Win32/BlackLotus CnC Activity (POST) (malware.rules) - 2044420 - ET PHISHING Successful CenturyLink Credential Phish 2023-03-01 (phishing.rules) ### Pro: - 2853607 - ETPRO MOBILE\_MALWARE Android.Spy.989 CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853608 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Piom.auye CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853609 - ETPRO MOBILE\_MALWARE Trojan.AndroidOS.Piom.auym CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853610 - ETPRO MOBILE\_MALWARE Trojan-Banker.AndroidOS.Rewardsteal.n CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853611 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.bf CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853612 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.bf CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853613 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.bf CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853614 - ETPRO MOBILE\_MALWARE Trojan-Dropper.AndroidOS.Hqwar.bf CnC Domain in DNS Lookup (mobile\_malware.rules) - 2853615 - ETPRO MALWARE Bitter APT CHM CnC Activity (GET) M3 (malware.rules)