# Weekly Community Review - November 15, 2023 **URL:** \ **Category:** Announcements\ **Created:** [November 17, 2023, 9:53pm UTC](https://community.emergingthreats.net/t/weekly-community-review-november-15-2023/1129 "2023-11-17T21:53:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [November 17, 2023, 9:53pm UTC](https://community.emergingthreats.net/t/weekly-community-review-november-15-2023/1129/1 "2023-11-17T21:53:25Z")
Greetings! Last week here at [Emerging Threats](https://community.emergingthreats.net) we kept moving forward with 71 entries into our ET Open IDS free and open ruleset. We had talked previously about #Cisco #IOSXE #CVE-2023-20198 and the exploit coverage we were able to release - thanks to more pcap information released by @[SI\_FalconTeam](https://twitter.com/SI_FalconTeam) we were able to make sure our alerts were tightened and accurate! > Thanks to @James_inthe_box for their tweet allowing us to alerts off of DNS Queries (SIDs 2049172-2049174) and TLS conenctivity (SIDs 2049175-2049177) for #RemCosRat connections out of your monitored environments > Remember, these sigs created from this burnt intel may have short lifespans w/r/t efficacy. For ET, each rule is created with a TTR (Time-To-Review) value which enables us to set the rule to be up for regular review! > [@Frequently Asked Questions](https://community.emergingthreats.net/t/frequently-asked-questions/56): > > What is Emerging Threats? Emerging Threats is a division of Proofpoint, Inc. Our primary projects are the Emerging Threats Ruleset, contributed and maintained by the security community, and the Emerging Threats Pro Ruleset, which is maintained by the Proofpoint/ET research team, as well as the Emerging Threats Intelligence Product. Are the Emerging Threats (Open) Rules REALLY free? Yup. Free, as in BSD licensed, which allows you to do what you like with them. All we ask is that when you have an… This @[zscaler](https://twitter.com/zscaler) #BanditStealer blog provided research for SID 2049122 (inbound config) and 2049123 (exfiltration of infected host details): > **[Bandit Stealer | ThreatLabz](https://www.zscaler.com/blogs/security-research/technical-analysis-bandit-stealer)** > > This blog provides an analysis of the most advanced info-stealer on the market Bandit Stealer. Harvests browsers, crypto wallet, credit card data and many more Shout out to @g0njxa (and @Jane0sint follow-up) for this post to our #Discourse - we want to make this a platform for #infosec #community discussions around the detection choices we all make, and this is a great contribution! > [@Vidar Stealer](https://community.emergingthreats.net/t/vidar-stealer/1106): > > This is going to be controversial. Vidar Stealer made a 180 degree change in their C2 traffic. This is the official statement from their panel both in Russian (original) and English (Translated) 6.4 — Большое обновление софтовой части Переписана полностью вся кодовая часть софта. Теперь отправка лога осуществляется частями(пофайлово). За счёт пофайловой отправки улучшили отстук порядка +15-20 процентов. Улучшили рантайм. Улучшили валидность гугла. Улучшили определение дубликатов (добавили нов… Check out this #TA402 @threatinsight blog - read about the #IronWind initial access downloader and the campaign details and mitigating detections (including ET Open rules!) within: > **[TA402 Targets Middle East Entities with IronWind Malware | Proofpoint US](https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-chains-target-middle-east-based-government)** > > Proofpoint observed IronWind malware focused on government entities based in the Middle East and North Africa. Learn more about TA402. And speaking of great @threatinsight content, check out our own @dumiller talking about his adventures detecting #FakeBrowser updates: [https://x.com/threatinsight/status/1724035679422660907?s=20](https://x.com/threatinsight/status/1724035679422660907?s=20) That’s it from us, take care all!