# 2010677 ET MALWARE Suspicious User-Agent (My Session)

**URL:** <https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127>\
**Category:** Rule Signatures\
**Tags:** false-positives\
**Created:** [December 5, 2025, 1:46pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127 "2025-12-05T13:46:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![segers](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@segers](https://community.emergingthreats.net/u/segers)\
**Post date:** [December 5, 2025, 1:46pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127/1 "2025-12-05T13:46:20Z")

</div>

Alerting on legitimate outbound traffic from Aquaveo software.

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [December 5, 2025, 4:31pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127/2 "2025-12-05T16:31:48Z")

</div>

Hi @segers , thanks! Can you share some traffic for analysis?

---

<div class="post-metadata">

**Author:** ![segers](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@segers](https://community.emergingthreats.net/u/segers)\
**Post date:** [December 5, 2025, 6:37pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127/3 "2025-12-05T18:37:16Z")

</div>

Please see attached.

Thank you!

> **(attachments)**
>
> [request\_1764773371.pcap](https://community.emergingthreats.net/uploads/short-url/kMw2edV87kO8ykPWNy1nfLtR4fM.pcap) (1.59 KB)

---

<div class="post-metadata">

**Author:** ![trobinson667](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/trobinson667/32/544_2.png) [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\
**Post date:** [December 5, 2025, 6:47pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127/4 "2025-12-05T18:47:01Z")

</div>

Hello @segers ,

thanks for the pcap. I’ve modified `2010677` to include a negation for the http.host field ending in `aquaveo.com`. These changes should go live tonight, with our daily rule releases. Provided everything goes smoothly, the daily release is typically available for download after 6pm EST.

Download and install the new ruleset at your convenience, and let us know if you continue experiencing FPs with this rule.

Thanks and happy Friday,

-Tony Robinson

---

<div class="post-metadata">

**Author:** ![segers](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@segers](https://community.emergingthreats.net/u/segers)\
**Post date:** [December 5, 2025, 7:00pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127/5 "2025-12-05T19:00:49Z")

</div>

Thank very much!