# Tutorials, Tips & Tricks **URL:** https://community.emergingthreats.net/c/tutorials-tips-tricks/13.md [Latest](https://community.emergingthreats.net/latest.md) · [Categories](https://community.emergingthreats.net/categories.md) · [Tags](https://community.emergingthreats.net/tags.md) --- ## [About the Tutorials, Tips & Tricks category](https://community.emergingthreats.net/t/about-the-tutorials-tips-tricks-category/37)
**Author:** [@dkaczmark](https://community.emergingthreats.net/u/dkaczmark)\ **Replies:** 0
Share your knowledge and learn something new. --- ## [EveBox Issue UI Lag: Logs not updating in Real-time](https://community.emergingthreats.net/t/evebox-issue-ui-lag-logs-not-updating-in-real-time/3230)
**Author:** [@Hoisang](https://community.emergingthreats.net/u/Hoisang)\ **Replies:** 1\ **Last updated:** [March 17, 2026, 8:56pm UTC](https://community.emergingthreats.net/t/evebox-issue-ui-lag-logs-not-updating-in-real-time/3230 "2026-03-17T20:56:28Z")
I’m facing an issue where EveBox GUI is not displaying logs in real-time. It causes me to miss critical alerts and I have to manually check raw logs/emails instead. Any tips on optimizing EveBox or Elasticsearch for bett… --- ## [Help with Custom Suricata Rule for specific Attack Testing](https://community.emergingthreats.net/t/help-with-custom-suricata-rule-for-specific-attack-testing/3227)
**Author:** [@Hoisang](https://community.emergingthreats.net/u/Hoisang)\ **Replies:** 3\ **Last updated:** [March 13, 2026, 3:28pm UTC](https://community.emergingthreats.net/t/help-with-custom-suricata-rule-for-specific-attack-testing/3227 "2026-03-13T15:28:35Z")
Hi everyone, I’m trying to create a custom Suricata rule to detect a specific attack test, but it’s not triggering as expected. Could someone review my rule logic based on this traffic pattern? --- ## [Are Google LLC IPs flagged as malicious really worth investigating?](https://community.emergingthreats.net/t/are-google-llc-ips-flagged-as-malicious-really-worth-investigating/3197)
**Author:** [@DnG](https://community.emergingthreats.net/u/DnG)\ **Replies:** 0\ **Last updated:** [February 15, 2026, 10:40pm UTC](https://community.emergingthreats.net/t/are-google-llc-ips-flagged-as-malicious-really-worth-investigating/3197 "2026-02-15T22:40:36Z")
Came accross 147.185.133.235 a ( Google LLC ) IP flagged by 11 security vendors as malicious on virustotal. Is it worth or its another rabbit hole --- ## [Cybersecurity Awareness Month - IoT and SOHO devices](https://community.emergingthreats.net/t/cybersecurity-awareness-month-iot-and-soho-devices/3095)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 9:27pm UTC](https://community.emergingthreats.net/t/cybersecurity-awareness-month-iot-and-soho-devices/3095 "2025-10-28T21:27:27Z")
Cyber Security Awareness Month - Securing IoT devices Earlier this month, I did a write-up on browser/web browsing security controls that can be used to help keep you and your user community secure at home, and at work. … --- ## [Cyber Security Awareness Month - Web Browser Security](https://community.emergingthreats.net/t/cyber-security-awareness-month-web-browser-security/3071)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [October 3, 2025, 3:29am UTC](https://community.emergingthreats.net/t/cyber-security-awareness-month-web-browser-security/3071 "2025-10-03T03:29:34Z")
Cybersecurity Awareness Month - Web Browser Security (and a few opinions on privacy) Hi everyone it’s October again. I don’t know how you all celebrate the leadup to Halloween, but generally I love cider, donuts, and can… --- ## [Detection Exercise: D-Link DIR-513 (CVEs: 2025-8184, 8169, and 8168)](https://community.emergingthreats.net/t/detection-exercise-d-link-dir-513-cves-2025-8184-8169-and-8168/2944)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [August 2, 2025, 7:45pm UTC](https://community.emergingthreats.net/t/detection-exercise-d-link-dir-513-cves-2025-8184-8169-and-8168/2944 "2025-08-02T19:45:00Z")
Detection Exercise: D-Link DIR-513 (CVEs: 2025-8184, 8169, and 8168) We’ve recently had an intern join the ET team (say hello to @kraghu). I went over how I turned a github repo with some PoC exploit code into a rule tha… --- ## [Come Sail the CVEs Part 1: Data Acquisition](https://community.emergingthreats.net/t/come-sail-the-cves-part-1-data-acquisition/2750)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 2\ **Last updated:** [July 10, 2025, 5:23pm UTC](https://community.emergingthreats.net/t/come-sail-the-cves-part-1-data-acquisition/2750 "2025-07-10T17:23:59Z")
Come Sail the CVEs Part 1 : Data Acquisition Today I’m going to teach you how to turn proof of concept exploits, blog posts, and general threat research into Suricata rules, or at least how I do it. It’s not terribly co… --- ## [Double Firewall Hopping with PfSense](https://community.emergingthreats.net/t/double-firewall-hopping-with-pfsense/2800)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [June 7, 2025, 10:15pm UTC](https://community.emergingthreats.net/t/double-firewall-hopping-with-pfsense/2800 "2025-06-07T22:15:10Z")
Double Firewall Hopping with PfSense Greetings, everyone. I’ve recently had to do some housekeeping in my lab environment as I prepare to expand, and write up some additional chapters for Suricata: An Operator’s Guide. M… --- ## [Come Sail the CVEs Part 2: Turning Data Into Rules](https://community.emergingthreats.net/t/come-sail-the-cves-part-2-turning-data-into-rules/2751)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 6:57pm UTC](https://community.emergingthreats.net/t/come-sail-the-cves-part-2-turning-data-into-rules/2751 "2025-05-21T18:57:14Z")
Come Sail the CVEs Part 2: Turning Data Into Rules Note: This post contains proof of concept exploits for several different platforms, both embedded in the post, as well as available through links in the post. Please act… --- ## [ET TOAD Rules Response Guidance](https://community.emergingthreats.net/t/et-toad-rules-response-guidance/2663)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 6:09pm UTC](https://community.emergingthreats.net/t/et-toad-rules-response-guidance/2663 "2025-04-24T18:09:57Z")
What are TOAD Attacks? Threat actors conduct telephone-oriented attack delivery (TOAD) attacks to engage recipients to follow instructions to call threat actors. TOAD attacks may be delivered from… a received email th… --- ## [Flexible Rule Writing: Seeing Around The Bend](https://community.emergingthreats.net/t/flexible-rule-writing-seeing-around-the-bend/2568)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [March 25, 2025, 6:17pm UTC](https://community.emergingthreats.net/t/flexible-rule-writing-seeing-around-the-bend/2568 "2025-03-25T18:17:23Z")
Hey Folks, I know you just saw me put down a pretty meaty blog post a few minutes ago, but this is another blogpost that is somewhat related. On top of that, I’m making it a personal goal this year to share a blog post … --- ## [Introduction to IOC Pivoting, and the Pyramid of Pain](https://community.emergingthreats.net/t/introduction-to-ioc-pivoting-and-the-pyramid-of-pain/2566)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [March 25, 2025, 3:52pm UTC](https://community.emergingthreats.net/t/introduction-to-ioc-pivoting-and-the-pyramid-of-pain/2566 "2025-03-25T15:52:40Z")
Couple of days ago, my boss introduced me to this great blog post by sekoia.io, about the PolarEdge botnet. I love tearing apart research to make (hopefully) good IDS sigs for finding future exploit attempts, and/or ret… --- ## [Changes to ET SocGholish Rule Names to Reflect TA569 and TA2726/2727 Activity](https://community.emergingthreats.net/t/changes-to-et-socgholish-rule-names-to-reflect-ta569-and-ta2726-2727-activity/2519)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 0\ **Last updated:** [March 13, 2025, 9:57pm UTC](https://community.emergingthreats.net/t/changes-to-et-socgholish-rule-names-to-reflect-ta569-and-ta2726-2727-activity/2519 "2025-03-13T21:57:26Z")
The ET SocGholish Rules Response Guidance post was published around Feb 2023 and ET continues to recommend the investigative next steps provided. Today, we wanted to share that former SocGholish rule names have changed … --- ## [ET SocGholish Rules Response Guidance](https://community.emergingthreats.net/t/et-socgholish-rules-response-guidance/335)
**Author:** [@dumiller](https://community.emergingthreats.net/u/dumiller)\ **Replies:** 2\ **Last updated:** [March 12, 2025, 8:14am UTC](https://community.emergingthreats.net/t/et-socgholish-rules-response-guidance/335 "2025-03-12T08:14:58Z")
What is SocGholish? SocGholish is an opportunistic threat that uses malicious JavaScript injects in legitimate websites to serve a Fake Browser Update that downloads a .js file, usually compressed in a .zip file. You can… --- ## [Snort 3 Install Guide for Modern Debian Distributions](https://community.emergingthreats.net/t/snort-3-install-guide-for-modern-debian-distributions/1620)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [May 8, 2024, 6:23pm UTC](https://community.emergingthreats.net/t/snort-3-install-guide-for-modern-debian-distributions/1620 "2024-05-08T18:23:19Z")
Hey folks, Long time, no post. I wanted to take some time to share a small project I was working on: A Snort 3 Installation guide. My installation guide guides users on how to install Snort 3 on most modern Debian-base… --- ## [Addressing HTTP/2 in Suri7](https://community.emergingthreats.net/t/addressing-http-2-in-suri7/1104)
**Author:** [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\ **Replies:** 0\ **Last updated:** [November 8, 2023, 7:52pm UTC](https://community.emergingthreats.net/t/addressing-http-2-in-suri7/1104 "2023-11-08T19:52:37Z")
Updated 2024-02-21 There has been significant progress within Suricata 7.0 to allow a single rule to support both HTTP/1 and HTTP/2. However, there are many changes that must be made to rules in order to allow this beh… --- ## [Vidar Stealer Picks Up Steam!](https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271)
**Author:** [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Replies:** 1\ **Last updated:** [January 12, 2024, 9:03pm UTC](https://community.emergingthreats.net/t/vidar-stealer-picks-up-steam/271 "2024-01-12T21:03:17Z")
Emerging Threats has observed an uptick in Vidar Stealer malware that abuses Steam user profiles to distribute C2 server configuration. Vidar Stealer is an information stealer that is either a fork or related to the Arke… --- ## [Get Started with Suricata CLI Debugging](https://community.emergingthreats.net/t/get-started-with-suricata-cli-debugging/1195)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 0\ **Last updated:** [December 11, 2023, 10:09pm UTC](https://community.emergingthreats.net/t/get-started-with-suricata-cli-debugging/1195 "2023-12-11T22:09:44Z")
Let’s review how to debug Suricata rules from the command line. If you want to troubleshoot your rules or the Suricata engine itself, then CLI debugging is an invaluable skill to have! The following Suricata bug inspir… --- ## [Prefilter Keyword Usage and Signature Performance](https://community.emergingthreats.net/t/prefilter-keyword-usage-and-signature-performance/1035)
**Author:** [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Replies:** 0\ **Last updated:** [October 13, 2023, 1:57pm UTC](https://community.emergingthreats.net/t/prefilter-keyword-usage-and-signature-performance/1035 "2023-10-13T13:57:35Z")
The prefilter keyword allows Suricata to use keywords that are not part of the multi-pattern-matcher detection engine as fast\_patterns. (prefilter reference: 8.10. Prefiltering Keywords — Suricata 7.0.2-dev documentation)… --- ## [Handling False Positive Reports as A Rule Writer! Special Guests: PCREs, Dalton, Dalton’s Flowsynth](https://community.emergingthreats.net/t/handling-false-positive-reports-as-a-rule-writer-special-guests-pcres-dalton-dalton-s-flowsynth/1031)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 11\ **Last updated:** [October 12, 2023, 7:20pm UTC](https://community.emergingthreats.net/t/handling-false-positive-reports-as-a-rule-writer-special-guests-pcres-dalton-dalton-s-flowsynth/1031 "2023-10-12T19:20:12Z")
Hi All, This post reviews how you may want to troubleshoot False Positive alerts from a Suricata Rule. If you already have an established troubleshooting flow, then I suggest you stick around for the later discussion ab… --- ## [If you get the alert "ET POLICY Vulnerable Java Version 1.8.x Detected"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-policy-vulnerable-java-version-1-8-x-detected/965)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 2\ **Last updated:** [September 22, 2023, 4:23pm UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-policy-vulnerable-java-version-1-8-x-detected/965 "2023-09-22T16:23:10Z")
Some PCs in your network use an outdated version of Java 8 JDK/JRE. The version numbers are a bit confusing because for historical reasons the internal version has a leading 1, e.g. “Build 1.8.0\_381-b09” for Version 8 U… --- ## [If you get the alert "ET INFO Microsoft Connection Test"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-microsoft-connection-test/979)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 0\ **Last updated:** [September 22, 2023, 11:42am UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-microsoft-connection-test/979 "2023-09-22T11:42:22Z")
This signature indicates that Microsoft Windows tries to download the text file http://www.msftconnecttest.com/connecttest.txt to determine if the internet is up. This is reflected by the network tray icons and is contr… --- ## [If you get the alert "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-policy-gnu-linux-apt-user-agent-outbound-likely-related-to-package-management/978)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 0\ **Last updated:** [September 22, 2023, 11:30am UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-policy-gnu-linux-apt-user-agent-outbound-likely-related-to-package-management/978 "2023-09-22T11:30:45Z")
These alerts come in bursts from Linux (e.g. Ubuntu) machines when they search for updates on repository servers. --- ## [If you get the alert "ET INFO TLS Handshake Failure"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-tls-handshake-failure/966)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 0\ **Last updated:** [September 20, 2023, 12:56pm UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-tls-handshake-failure/966 "2023-09-20T12:56:42Z")
This signature seems to appear when using a chrome-based browser with some specific (insecure?) TLS 1.2 certificates. In a Chrome based browser press the F12 key and go to the security tab to see the TLS version. It … --- ## [If you get the alert "ET INFO Session Traversal Utilities for NAT (STUN Binding Request)"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-session-traversal-utilities-for-nat-stun-binding-request/751)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 1\ **Last updated:** [September 20, 2023, 12:34pm UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-info-session-traversal-utilities-for-nat-stun-binding-request/751 "2023-09-20T12:34:45Z")
As well as the alert “ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)” on the ports 19302​–19309 it is most likely triggered by somebody using Google Meet. See also: Updat… --- ## [Android/MMRAT : Additional Analysis](https://community.emergingthreats.net/t/android-mmrat-additional-analysis/943)
**Author:** [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\ **Replies:** 0\ **Last updated:** [September 14, 2023, 8:07pm UTC](https://community.emergingthreats.net/t/android-mmrat-additional-analysis/943 "2023-09-14T20:07:49Z")
Hello! Today, I wanted to talk about the Android MMRAT Banking Trojan. This trojan has a ton of features and was covered very well by a recent Trend Micro blog post here: and for those of you wanting IOCs, they poste… --- ## [If you get the alert "ET USER\_AGENTS Microsoft Device Metadata Retrieval Client User-Agent"](https://community.emergingthreats.net/t/if-you-get-the-alert-et-user-agents-microsoft-device-metadata-retrieval-client-user-agent/748)
**Author:** [@vpx](https://community.emergingthreats.net/u/vpx)\ **Replies:** 1\ **Last updated:** [August 28, 2023, 1:59pm UTC](https://community.emergingthreats.net/t/if-you-get-the-alert-et-user-agents-microsoft-device-metadata-retrieval-client-user-agent/748 "2023-08-28T13:59:03Z")
If you use a windows server domain controller (DC) you can turn off the cause of this alert by creating a GPO in the group policy editor. The needed path is described here: To prevent Windows from retrieving device … --- ## [Translating Suricata http.header\_names content to Snort](https://community.emergingthreats.net/t/translating-suricata-http-header-names-content-to-snort/806)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 3\ **Last updated:** [July 27, 2023, 12:54am UTC](https://community.emergingthreats.net/t/translating-suricata-http-header-names-content-to-snort/806 "2023-07-27T00:54:00Z")
Emerging Threats aims to provide detection for Suricata and Snort users with its rulesets. Today, the rulesets supports Suricata (4.0.5 and 5.0.0) and Snort (2.9.17). For myself, I can say that I write rules in Suricata… --- ## [Understanding Signature Direction](https://community.emergingthreats.net/t/understanding-signature-direction/767)
**Author:** [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Replies:** 0\ **Last updated:** [July 14, 2023, 9:08pm UTC](https://community.emergingthreats.net/t/understanding-signature-direction/767 "2023-07-14T21:08:10Z")
Which Direction? When looking at Suricata IDS signatures it is important to understand the directional aspects of the signature. There are a few components in the signature that make up the direction aspect: Source Net… [Next page](https://community.emergingthreats.net/c/tutorials-tips-tricks/13.md?page=1)