# Weekly Community Review - February 17, 2023 **URL:** \ **Category:** Announcements\ **Created:** [February 18, 2023, 1:17am UTC](https://community.emergingthreats.net/t/weekly-community-review-february-17-2023/319 "2023-02-18T01:17:34Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [February 18, 2023, 1:17am UTC](https://community.emergingthreats.net/t/weekly-community-review-february-17-2023/319/1 "2023-02-18T01:17:34Z")
Hey again, it’s been another great week of Suricata and IDS community collaboration. We’ve had 68 rules contributed to ET Open this week. Here’s the story on just a few of them, and the people and orgs that’ve helped us get there! Following the Gamaredon SID from last week,[@StopMalvertisin](https://twitter.com/StopMalvertisin) [aids](https://twitter.com/StopMalvertisin/status/1625032155255689216) again with another tip on same - SID 2044197, “ET MALWARE Gamaredon APT Related Activity (GET)”. Two from our [friend](https://twitter.com/jaydinbas/status/1625133287361355776) [@jaydinbas](https://twitter.com/jaydinbas), both DonotGroup domain SIDs around the DNS query (2044198) and the TLS handshake (2044199). [Here](https://community.emergingthreats.net/t/gitlab-pre-auth-rce-cve-2021-22205-signature/308/4) on our Discourse site, productive collaboration between ET’s own @bingohotdog and our friend @cosmicgumbo for CVE-2021-22205 coverage - take a look and see how Cyberchef and other analysis helped identify the meat for SID 2044201! From [@Cyber0verload](https://twitter.com/Cyber0verload), a [tip up](https://twitter.com/Cyber0verload/status/1623008687311708160) on Gamaredon APT lending to an alert on a DNS lookup against an involved domain: SID 2044209. A reminder from our [FAQ](https://community.emergingthreats.net/t/frequently-asked-questions/56) : Each of our rules is created with a Time-To-Review value. Our rule writers have the ability to set a rule to be reviewed in 30/60/90 day increments. At those points a rule can be set to be permanent, be deferred for review, or be disabled. Next up,[@cyberwar\_15](https://twitter.com/cyberwar_15) [tweet](https://twitter.com/cyberwar_15/status/1435260403127255043) keying us up to render SID 2033908 an outbound GET with a content pattern matching a malicious OneDrive download. SID 2044206, alerting on [a macOS updater](https://objective-see.org/blog/blog_0x72.html)… Public postings by the industry help us out as well, here’s a few we sig’d on this week… from [@ahnlab](https://twitter.com/ahnlab), SIDs 2044236-2044241, [various inbound](https://asec.ahnlab.com/ko/47622/) APT37 M2RAT C2 commands. from [@symantec](https://twitter.com/symantec), SIDs 2044231 and 2044232, both Win32/frebniis IIS Backdoor Trigger Attempts. Identified detection logic from byte patterns and POST content from [this posted blog](https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/frebniis-malware-iis). CVE-2021-22205 coverage from SID 2044201 thanks to [http://hackerone.com/reports/1154542](https://t.co/4XPQy7Ax6v) and [ExifTool CVE-2021-22204 - Arbitrary Code Execution | devcraft.io](https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html) Another CVE, CVE-2022-48323 (identified directory traversal attempt) coverage within SID 2044205 thanks to [@tenable](https://twitter.com/tenable)’s reporting of the crafted HTTP request here: [CVE-2022-48323 | Tenable®](https://www.tenable.com/cve/CVE-2022-48323) Lastly, big thanks to [@James\_inthe\_box](https://twitter.com/James_inthe_box) for his aid in helping us make changes to our existing laplas clipper rules (SIDs 2039775-2039777). After threat actors started moving around parameters in their C2 traffic a sample he provided allowed us to properly tune. Great collab!