Possible malware found in Suricata ET Open rules files themselves!

Rule Signatures
, ,
1

Hi. I have a rather odd problem. When I scan my computers for viruses, the Suricata rules file itself is flagged as containing malware! So is the update file from EmergingThreats Open.

ClamAV flags these files when configured with a high file size limit of 2 GB and when configured to scan for Potentially Unwanted Applications. When I upload the files to VirusTotal.com, several of their vendors detect malware as well. See, for example, VirusTotal

Is this a known problem? Is it expected that something like this might happen? Or are my computers so infected that even my security software has viruses? Or what?

2

Greetings - the rules file is a benign text file - certain static analysis engines may find detection content literals or byte patterns or regexes within as malicious but they are simply there as detection content and rule logic.

2 Likes