# Weekly Community Review - July 24, 2023

**URL:** <https://community.emergingthreats.net/t/weekly-community-review-july-24-2023/843>\
**Category:** Announcements\
**Created:** [August 7, 2023, 10:45pm UTC](https://community.emergingthreats.net/t/weekly-community-review-july-24-2023/843 "2023-08-07T22:45:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [August 7, 2023, 10:45pm UTC](https://community.emergingthreats.net/t/weekly-community-review-july-24-2023/843/1 "2023-08-07T22:45:38Z")

</div>

Welcome back to our wrap-up threads! While a little delayed we wanted to still talk about the (last) week that was - through the efforts of the information security community’s researchers and partners we were able to add 60 rules to the #etopen ruleset! Again, these are free to download via flat download directly, or a rule management helper like suricata-update (et/open) at any time. Have at them.

And we love feedback - you can use the feedback portion of our #Discourse site here [Feedback & Support - Emerging Threats](https://community.emergingthreats.net/c/feedback-support/8), hit us up here on twitter, or the mail us at support@emergingthreats[dot]net.

In any case, lets talk about some recent rules and how they came to be.

From friend @StopMalvertisin, SID 2046825 came from this tweet, a sample hash whose detonation allowed us to craft detection logic matching the method around the GET for this #Konni #APT #C2 activity.

> <https://twitter.com/StopMalvertisin/status/1680844712675270656>

From @maddiestone, @\_clem1, and @\_JohnHammond, this link to a @Zimbra disclosure blog allowed SID 2046829 to alert on an inbound XSS attempt against your Zimbra instance.

> <https://twitter.com/_JohnHammond/status/1679606263162994689/>

here, @AnFam17 gives a breakdown of #RogueRaticate dropping #NetSupportRAT - SIDs 2046863 & 2046864 alert on #RogueRaticate DNS lookups by clients within your monitored infrastructure, 2046869-2046871 the TLS SNI for associated domains, and 2046865 Keitaro TDS cooking sent to #RogueRaticate.

> <https://twitter.com/AnFam17/status/1671789322259800064>

From zscaler, this writeup of #BanditStealer, a Golang malware targeting desktop cryptocurrency wallets aided SID 2046856 which will alert on its exfil via #Telegram.

> **[Technical Analysis of Bandit Stealer | Zscaler](https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer)**
>
> This blog provides an analysis of the most advanced info-stealer on the market Bandit Stealer. Harvests browsers, crypto wallet, credit card data and many more

Forever thanks to friend of ET @travisbgreen, tipping up findgs that led to SID 2046861 firing on an identified Kaiten user agent.

and Lastly, thanks to @h2jazi and @greglesnewich on two TA430/Andariel check-in methods - SIDs 2046881 & 2046882 reflecting alerts on POST activity observed - much appreciated!

> <https://twitter.com/h2jazi/status/1681426768597778440>

Thanks all - we’ll be back at our regularly scheduled weekly summation time on Friday!