# Weekly Community Review - February 3, 2023 **URL:** \ **Category:** Announcements\ **Created:** [February 4, 2023, 1:23am UTC](https://community.emergingthreats.net/t/weekly-community-review-february-3-2023/299 "2023-02-04T01:23:21Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [February 4, 2023, 1:23am UTC](https://community.emergingthreats.net/t/weekly-community-review-february-3-2023/299/1 "2023-02-04T01:23:21Z")
It’s Friday, and this week we’ve had over 100 [#suricata](https://twitter.com/hashtag/suricata?src=hashtag_click) signatures contributed to our ET Open rulset from the [#infosec](https://twitter.com/hashtag/infosec?src=hashtag_click) community! Lets take a walk through a few… There are many ways to reach out to us with a tip-up on an interesting hash, article, or detection logic you’ve created - on [twitter](https://twitter.com/et_labs), here on Discourse, on our mailing list via support[at]emergingthreats[dot]net or on our Discord (hit us up via DM for an invite!). SID 2044022, a TLS SNI signature alerting on an outbound connection to an identified APT actor-controlled domain, [thanks](https://twitter.com/h2jazi/status/1618347920792907777) to[@h2jazi](https://twitter.com/h2jazi)! On the same score, SID 2044023 which was aided by[@k3yp0d](https://twitter.com/k3yp0d)’s [follow up](https://twitter.com/k3yp0d/status/1618539713228574721) observation! SID 2044044, our friend[@jaydinbas](https://twitter.com/jaydinbas) [posting](https://twitter.com/jaydinbas/status/1620386706657796096) a sample that allowed us to write a sig alerting on an identified URL and UA string pattern identifying potential Lazarus APT outbound GET activity. [Here](https://community.emergingthreats.net/t/gcleaner-sig-submission/290/2) on our Discourse site, @cosmicgumbo submitting multiple GCleaner sigs–aided by ET’s @trobinson667 these became SIDs 2044031-2044034 and ETPRO SID 2852925 was moved to ET Open 2044037 Great submission, feedback, and collaboration. Check it out! Discourse member @NoahWolf with a sig from an[@anyrun\_app](https://twitter.com/anyrun_app) sample & our own @bmurphy providing analysis and feedback: advising to focus on identifying the consistent meat to write detection logic on so the sig will be more resilient. SID 2043206 is born! Publicly posted information is important to us too - [this](https://t.co/l29mcxN2s8) [@WithSecure](https://twitter.com/WithSecure) report allowed us to write SID 2044086 modeling the GET URL path for identified DPRK malware. A friend of ET passes on [this](https://t.co/OgfuaGp0QK) post, listing domains being used by Microsoft for phishing attack simulation training. Detect this, with SIDs 2044087-2044110! Giving back to the community [@threatinsight](https://twitter.com/threatinsight) Josh Miller gave a [recorded talk](https://www.youtube.com/watch?t=18569&v=_AvP4x5MIAQ&feature=youtu.be&ab_channel=SANSInstitute) at [@SANSInstitute](https://twitter.com/SANSInstitute) Cyber Threat Intelligence summit on TA453. This week[@OISFoundation](https://twitter.com/OISFoundation) released [#suricata](https://twitter.com/hashtag/suricata?src=hashtag_click) 6.0.10 and 7.0.0 RC1. ET and other community contributions are thanked in the release notes, and ET support for Suricata 7 is coming soon! [https://suricata.io/2023/01/31/suricata-6-0-10-released/](https://t.co/hItMdUdQdn) Enjoy the weekend everyone, and thanks again for all the great submissions, collaboration, and feedback!