diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7686aa1c..aaf225fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,7 @@ It includes many new rules, including all new techniques introduced in MITRE ATT
 - main: use FLIRT signatures to identify and ignore library code #446 @williballenthin
 - explorer: IDA 7.6 support #497 @williballenthin
 
-### New Rules (65)
+### New Rules (66)
 
 - anti-analysis/packer/amber/packed-with-amber @gormaniac
 - collection/file-managers/gather-3d-ftp-information @re-fox
diff --git a/rules b/rules
index 78f16193..376e2179 160000
--- a/rules
+++ b/rules
@@ -1 +1 @@
-Subproject commit 78f1619386be28f4c9b17ef8ed6f9e9334376b39
+Subproject commit 376e217916ec16f302ee10dc167805219b84c514