# Weekly Community Review - June 9, 2023 **URL:** \ **Category:** Announcements\ **Created:** [June 12, 2023, 2:19pm UTC](https://community.emergingthreats.net/t/weekly-community-review-june-9-2023/641 "2023-06-12T14:19:46Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [June 12, 2023, 2:19pm UTC](https://community.emergingthreats.net/t/weekly-community-review-june-9-2023/641/1 "2023-06-12T14:19:46Z")
Greetings all! It’s the end of the week at [@et\_labs](https://twitter.com/et_labs) and it’s been a great one for our #etopen #suricata and #Snort IDS rules. 118 rules were created from contributions from researchers and the industry, and we’ll take this time to review a few… from [@crep1x](https://twitter.com/crep1x), SIDs 2046103-2046106 covering #Redline #Stealer chain from stage page inbound presentation through out C2 activity. [https://twitter.com/crep1x/status/1666132533912776725](https://twitter.com/crep1x/status/1666132533912776725) from @[StopMalvertisin](https://twitter.com/StopMalvertisin), Request and Retrieval sigs for #SharpPanda #APT within 2046146-2046148… [twitter.com/StopMalvertisin/status/1663461621120000010](http://twitter.com/StopMalvertisin/status/1663461621120000010) Kind twitter tags from friend @[Cyber0verload](https://twitter.com/Cyber0verload) rendering #Gamaredon #APT domain SIDs: 2046080-2046097. Remember, malicious domains found in your DNS alerts and logs are the beginning of an investigation, not the end. [twitter.com/Cyber0verload/status/1665076262191218690](http://twitter.com/Cyber0verload/status/1665076262191218690) From @[kaspersky](https://twitter.com/kaspersky), Network Security Monitoring of Apple devices within their environment revealed compromise with iOS. Details are spare, but they did publish this report giving us multiple C2 domains (SIDs 2046131-2046145) noticed from the malware’s external connections. If you’re smartly monitoring network traffic your devices can reveal compromise! Their analysis continues and we await further developments. > **[Operation Triangulation: iOS devices targeted with previously unknown malware](https://securelist.com/operation-triangulation/109842/)** > > While monitoring the traffic of our own corporate Wi-Fi network, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS devices from the inside, we created offline backups of the... We use our #Discourse site to dig a little deeper into the ruleset and the choices we make than we can here on twitter. Here, our own @James talks about the challenges we have - the pitfalls and possibilities that #suricata and #Snort present and how we use metadata tags for exploit coverage sigs: [Rule Metadata & Exploit Signature Difficulties](https://community.emergingthreats.net/t/rule-metadata-exploit-signature-difficulties/635) And speaking of Discourse - stop by and drop us a line. Friend @Jane0sint posts up sigs for ruleset adoption and you can too! Check this thread out - SIDs 2046150-2046155 and 2046169-2046170 on Win32/ObserverStealer (various) activities and response. They’ve posted a tweet thread and gh link with more info - check it out! > [@ObserverStealer](https://community.emergingthreats.net/t/observerstealer/624): > > Hi all! A fairly new stealer was discovered today that leaves a note with an advertisement on the victim’s computer) This is very strange… I propose the following set of rules for detection: alert http any any -\> any any (msg: "ET MALWARE [ANY.RUN] ObserverStealer (Screenshot)";flow: established, to\_server; http.method; content: "POST"; http.header; content: "X-Config: SCR|0d0a|"; content: "X-Session: "; pcre: "/^([0-9a-f]{8})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{12})/R";content:… Another as well - read how the medium article from @[Gi7w0rm](https://twitter.com/Gi7w0rm) and @[tosscoinwitcher](https://twitter.com/tosscoinwitcher) inspires the @Jane0sint rule submission (2046187) into #etopen > [@DynamicRAT](https://community.emergingthreats.net/t/dynamicrat/634/2): > > thanks again @Jane0sint, awesome find ! Here’s the sig that went out today 2046187 - ET MALWARE [ANY.RUN] Win32/DynamicRAT CnC Activity And also from [@Gi7w0rm](https://twitter.com/Gi7w0rm), SIDs covering 3 checkin methods for DarkVision RAT infections: 2045618-2045620 [twitter.com/Gi7w0rm/status/1655327430372995075](http://twitter.com/Gi7w0rm/status/1655327430372995075) Lastly, big thanks and continuing best wishes to friend of ET [@kk\_onstantin](https://twitter.com/kk_onstantin) for his tip-up of the [@nextronsystems](https://twitter.com/nextronsystems) & [@eclecticiq](https://twitter.com/eclecticiq) links here which led to 2046076 covering Win32/DarkPink KamiKakaBot outbound/exfil modeling http content literals for alerting! [Dark Pink APT Group Strikes Government Entities in South Asian Countries](http://blog.eclecticiq.com/dark-pink-apt-group-strikes-government-entities-in-south-asian-countries)[Rule Info APT\_DarkPink\_KamiKakaBot\_Mar23 - Valhalla](http://valhalla.nextron-systems.com/info/rule/APT_DarkPink_KamiKakaBot_Mar23) Take care all, be well!