# Weekly Community Review - September 6, 2023 **URL:** \ **Category:** Announcements\ **Created:** [September 14, 2023, 6:33pm UTC](https://community.emergingthreats.net/t/weekly-community-review-september-6-2023/942 "2023-09-14T18:33:11Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [September 14, 2023, 6:33pm UTC](https://community.emergingthreats.net/t/weekly-community-review-september-6-2023/942/1 "2023-09-14T18:33:11Z")
Greetings from ET! It was a full week last week for us–and thanks to the collaborative efforts of the #InfosecCommunity and shared industry research we were able to add 130 rules to our #etopen #suricata and #snort #IDS rulesets. We’ll shout-out a few of those in this thread. Thanks to [@rmceoin](https://twitter.com/rmceoin)’s writeup on what they’re calling #ClearFake #malware, we were able to release SIDs 2047858-2047861 for both DNS alerts and TLS communication to identified domains! [https://rmceoin.github.io/malware-analysis/clearfake/](https://rmceoin.github.io/malware-analysis/clearfake/) Friend @[suyog41](https://twitter.com/suyog41) with the hashes that led to two #IOC-based (#TA409 #APT37) SIDs: 2047881 (DNS lookup alert) and 2047882 (TLS SNI identification): [https://twitter.com/suyog41/status/1697536913610314016](https://twitter.com/suyog41/status/1697536913610314016) This from @[fr0s7\_](https://twitter.com/fr0s7_) (and supplemental information from @[JAMESWT\_MHT](https://twitter.com/JAMESWT_MHT)) - a hash and c2 share with an [anyrun](https://twitter.com/anyrun_app) sandbox run powered 2047883 - that research allowed us to model and alert against the outbound checkin behavior for #Konni #APT: [https://twitter.com/fr0s7\_/status/1697506531724419277](https://twitter.com/fr0s7_/status/1697506531724419277) Looking at those rules - notice the MITRE ATT&CK Framework metadata tags. C2 checkin activity (Tactic TA0011, Technique T1071) is labeled here - and MITRE tagging is available within #etpro and #etopen signatures where possible. Take a look at our other tags: [Signature Metadata](https://community.emergingthreats.net/t/signature-metadata/96) Speaking of our #Discourse site (which we love to do) friends @Jane0sint and @James_inthe_box collaborated on this #BoxClipper research leading to @Jane0sint’s submission of 3 new SIDs (2047821-2047823) - read their analysis here! > [@TheBoxClipper](https://community.emergingthreats.net/t/theboxclipper/904): > > Hi, I decided to dedicate this rule to our good friend and researcher @James_inthe_box. He discovered the clipper and we wanted to come up with a name, so I decided)) Apparently, the request is hardcoded in the traffic, so I have three rules, two of which are for http and one for tcp: alert http any any -\> any any (msg: "ET MALWARE [ANY.RUN] TheBoxClipper (addbild)";flow: established, to\_server; http.request\_line; content: "GET /addbild/"; pcre: "/\/[a-f0-9]{32}$/R"; classtype: trojan-activi… We post-up our own research and guidance there on #Discourse. In this post ET’s own @ishaughnessy talks about #ntopng and integrating #suricata #IDS alerts into its processing and visualizations: [How To: Integrate Suricata Events and Ntopng](https://community.emergingthreats.net/t/how-to-integrate-suricata-events-and-ntopng/889) From @kevross33 , a kind rule submission alerting on #APT28 #Sandworm data exfiltration became SID 2047880: > [@SIG: ET MOBILE\_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration](https://community.emergingthreats.net/t/sig-et-mobile-malware-android-infamouschisel-infostealer-apt28-sandworm-data-exfiltration/913): > > Hi, Here is a rule created from page 17 of this report [https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/infamous-chisel/NCSC-MAR-Infamous-Chisel.pdf](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/infamous-chisel/NCSC-MAR-Infamous-Chisel.pdf). This infostealer specific detection use case in Ukraine. Kind Regards, Kevin Ross alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MOBILE\_MALWARE Android/InfamousChisel.InfoStealer APT28/SANDWORM Data Exfiltration”; flow:established,to\_server; content:“POST”; http\_method; content:“/server.php?ver=”; http\_uri;… Old friend of ET @tgreen posted to our #Discord (hit us up for an invite!) and wrote a rule to provide coverage on CVE-2023-32315 #Openfire in SID 2047862. > **[Kinsing Malware Exploits Novel Openfire Vulnerability](https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability)** > > A new attack exploits the novel Openfire vulnerability (CVE-2023-32315) to deploy Kinsing malware and crypto miners to gain full control over the server. On the partner and community research and intelligence sharing side, our friends at the @[TheDFIRReport](https://TheDFIRReport) published this investigation on HTML Smuggling and their observations of ISO–\>IcedID–\>CobaltStrike–\>Nokoyawa @Ransomware. Check out the #etopen signatures referenced at the end which can aid detection on IcedID, Cobalt Strike use, lateral movement, and file transfer: > **[HTML Smuggling Leads to Domain Wide Ransomware - The DFIR Report](https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/)** > > We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved … Read More Lastly, From @[watchtowrcyber](https://twitter.com/watchtowrcyber) (thanks @[alizthehax0r](https://twitter.com/alizthehax0r)!) their writeup on #Juniper #JunOS vulnerabilities provided intelligence to coverage multiple steps of the associated chain: unauthenticated arbitrary file upload attempt (2047867), success (2047868), and PHPRC Environmental Variable Modifications (2047869-2047870) for CVE-2023-36846/CVE-2023-36847 coverage: > **[CVE-2023-36844 And Friends: RCE In Juniper Devices](https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/)** > > As part of our Continuous Automated Red Teaming and Attack Surface Management technology - the watchTowr Platform - we're incredibly proud of our ability to discover nested, exploitable vulnerabilities across huge attack surfaces. > > Through our rapid...