# Weekly Community Review - June 30, 2023 **URL:** \ **Category:** Announcements\ **Created:** [July 3, 2023, 1:16pm UTC](https://community.emergingthreats.net/t/weekly-community-review-june-30-2023/714 "2023-07-03T13:16:22Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [July 3, 2023, 1:16pm UTC](https://community.emergingthreats.net/t/weekly-community-review-june-30-2023/714/1 "2023-07-03T13:16:22Z")
Hello all - thanks to sharing and collaboration throughout the #suricata and #snort #IDS community we were able to add 79 rules to #etopen this week. Great work! We’ll talk about a few of those contributions now and see how some of those rules happened… A kind tag from [@Cyber0verload](https://twitter.com/Cyber0verload) led to SIDs 2046645-2046651 - these are alerts on #Gamaredon domains showing in the DNS lookup requests from hosts within your network(s). Potentially indicative of compromise, they should be treated in context as an indication that those hosts should be examined for further suspicious traffic or artifacts. [https://twitter.com/Cyber0verload/status/1673271585678020608](https://twitter.com/Cyber0verload/status/1673271585678020608) Still more #Gamaredon #APT coverage with [@StopMalvertisin](https://twitter.com/StopMalvertisin) allowing us to craft detection logic on C2 outbound activity from their hashes and content shares: [https://twitter.com/StopMalvertisin/status/1674460280900947970](https://twitter.com/StopMalvertisin/status/1674460280900947970) Check out our own @bingohotdog on the [@threatinsight](https://twitter.com/threatinsight) #DISCARDED podcast - lots of great information throughout each episode giving you a great view into the threat landscape and the great team we have working hard every day to protect and defend your information assets! [https://www.proofpoint.com/us/podcasts/discarded](https://www.proofpoint.com/us/podcasts/discarded) And speaking of, read downthread on this #Discourse post to our sit as @bingohotdog assisted by @trobinson667 responds to user @dspruell and @Jane0sint - there’s detailed thinking within on our own #QA processes and why we make some of the choices we make in putting our initial rule logic through the ringer to ensure the rules are performant for you and the community. Check it out! > [@Mystic Stealer signature](https://community.emergingthreats.net/t/mystic-stealer-signature/658/5): > > Perhaps this does not solve any of the problems listed above, but in my own style I would add a position in the stream. First rule 2046294: stream\_size: client, =, 5; stream\_size: server,=, 1; Second rule 2046295: stream\_size: client,=, 5; stream\_size: server, =, 257; Yes, as I write the rules for the sandbox, such a load on the sensor is quite acceptable for us. Shared community content from [@AuCyble](https://twitter.com/AuCyble) led to SIDs 2046643-2046644 - two SIDs covering #SupremeBot C2 checkin methods with the malware initially spread via game installer! Thanks for making your research visible to all! > **[Trojanized Super Mario Game Installer Spreads SupremeBot Malware](https://cyble.com/blog/trojanized-super-mario-game-installer-spreads-supremebot-malware/)** > > Cyble analyzes SupremeBot, a crypto-mining client leveraging a trojanized Super Mario game installer to spread Umbral stealer malware. From friend @Jane0sint , two SIDs today on Repl it and Duino-Pooh Coin Miners - thanks as always! [https://twitter.com/Jane\_0sint/status/1674824454185312257](https://twitter.com/Jane_0sint/status/1674824454185312257) Kudos to [@SANGFOR](https://twitter.com/SANGFOR) on this post - SID 2046669 alerts on #SparkRat C2 checkins thanks to their research and linked github code which allowed us to model the associated http header and user-agent information used by the RAT at work! > **[May Hot APT Security Events & Techniques Tracker](https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/may-hot-apt-security-events-techniques-tracker)** > > A monthly roundup of advanced persistent threat (APT) security events as well as the techniques employed by APT threat actors. And to [@sekoia\_io](https://twitter.com/sekoia_io) as well. This #DDoSia blog detailed the toolkit being used against countries critical of #Russia on #Ukraine built SIDs 2046697 (client checkin) and 2046698 (target list retrieval by client) for alerting on affected hosts within your views! > **[Following NoName057(16) DDoSia Project’s Targets](https://blog.sekoia.io/following-noname05716-ddosia-projects-targets/)** > > DDoSia is a DDoS attack toolkit used by the pro-Russia hacktivist group NoName057(16) against countries critical the invasion of Ukraine. Thanks all for the collaboration and community - take care!