diff --git a/README.md b/README.md
index b5a8981e..e01d5de2 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 ![capa](.github/logo.png)
 
 [![CI status](https://github.com/fireeye/capa/workflows/CI/badge.svg)](https://github.com/fireeye/capa/actions?query=workflow%3ACI+event%3Apush+branch%3Amaster)
-[![Number of rules](https://img.shields.io/badge/rules-434-blue.svg)](https://github.com/fireeye/capa-rules)
+[![Number of rules](https://img.shields.io/badge/rules-437-blue.svg)](https://github.com/fireeye/capa-rules)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE.txt)
 
 capa detects capabilities in executable files.
diff --git a/rules b/rules
index b2f83a5e..672d85ff 160000
--- a/rules
+++ b/rules
@@ -1 +1 @@
-Subproject commit b2f83a5edf8a621d0ee1b663ca6bda4a4024e668
+Subproject commit 672d85fff0423804dc4e2b6f0c2c3f6d8f1a78e2