ET-3466
📛 Threat Title
Possible malware found in Suricata ET Open rules files themselves!
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- Possible malware found in Suricata ET Open rules files themselves! Emerging Threats Community
Remediations (10)
-
web:8labs.id
How to choose Suricata IDS/IPS rulesets on OPNsense safely and effectively — which to enable, which to avoid, and recommended deployment strategies.
-
web:any.run
Determining the type of threat or a malware family using the Suricata rules much simplifies and speeds up the workflow of a cybersecurity professional during file analysis. Signatures from the Open Sandbox's rulesets are available for the Community plan's users. And with a Hunter subscription, you get access to more accurate and fresh Pro sets.
-
web:community.emergingthreats.net
Discussion for Suricata and Snort rule signatures.
-
web:docs.opnsense.org
Without trying to explain all the details of an IDS rule (the people at Suricata are way better in doing that), a small example of one of the ET-Open rules usually helps understanding the importance of your home network.
-
web:docs.securityonion.net
About Rules NIDS NIDS (Network Intrusion Detection System) rules are loaded into Suricata to monitor network traffic for suspicious or noteworthy activity. Active NIDS rules generate alerts that can be found in Alerts. Managing Existing NIDS Rules You can manage existing NIDS rules using Detections. There are two ways to do so: From the main Detections interface, you can search for the desired ...
-
web:docs.suricata.io
9.1. Rule Management with Suricata -Update While it is possible to download and install rules manually, it is recommended to use a management tool for this. suricata -update is the official way to update and manage rules for Suricata . suricata -update is bundled with Suricata and is normally installed with it.
-
web:docs.suricata.io
9.1. Rule Management with Suricata -Update While it is possible to download and install rules manually, it is recommended to use a management tool for this. suricata -update is the official way to update and manage rules for Suricata . suricata -update is bundled with Suricata and is normally installed with it.
-
web:forum.suricata.io
New Features in Suricata 7.0.3 While you could compare and contrast features from the Suricata 5 Read the Docs page and the Suricata 7.0.3 read the docs page, it doesn't answer the big question: What are some big changes that may be relevant to the future of the Emerging Threats ruleset? Additional Transformations
-
web:forum.suricata.io
This allowed for the creation of the emerging-trojan. rules file . On 2023-04-07, the placement of the rules in the TROJAN category was brought to our attention and then we moved the rules back to the MALWARE category placing the rules into the emerging- malware . rules and would have removed the emerging-trojan. rules file from the ruleset. Possible ...
-
web:github.com
Collaborative repository of Suricata IDS rules , organized by malware families and types. All rules are stored under the rules / directory, grouped by malware type (e.g., ransomware, trojan) and then by family. An automated workflow collects all . rules files into a single latest. rules file for easy deployment. Ideal for security teams, researchers, and enthusiasts who want to share, maintain ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.