NMAP ruleset are FP?

Rule Signatures
,
1

Does anyone know why several rules that identified portscan were removed? 2009582 for example

# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sS window 1024"; fragbits:!D; dsize:0; flags:S,12; ack:0; window:1024; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2009582; classtype:attempted-recon; sid:2009582; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
2

Hey, the rule you referenced has not been removed or deleted, it is simply disabled. This was one of many rules that we have chosen to disable by default to improve the performance of the default ruleset before any curations are made.

1 Like