# Possible malware found in Suricata ET Open rules files themselves! **URL:** \ **Category:** Rule Signatures\ **Tags:** suricata, malware, etopen\ **Created:** [September 28, 2026, 4:28am UTC](https://community.emergingthreats.net/t/possible-malware-found-in-suricata-et-open-rules-files-themselves/3466 "2026-09-28T04:28:26Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Uyakon](https://avatars.discourse-cdn.com/v4/letter/u/c0e974/32.png) [@Uyakon](https://community.emergingthreats.net/u/Uyakon)\ **Post date:** [September 28, 2026, 4:28am UTC](https://community.emergingthreats.net/t/possible-malware-found-in-suricata-et-open-rules-files-themselves/3466/1 "2026-09-28T04:28:26Z")
Hi. I have a rather odd problem. When I scan my computers for viruses, the Suricata rules file itself is flagged as containing malware! So is the update file from EmergingThreats Open. ClamAV flags these files when configured with a high file size limit of 2 GB and when configured to scan for Potentially Unwanted Applications. When I upload the files to [VirusTotal.com](http://VirusTotal.com), several of their vendors detect malware as well. See, for example, [VirusTotal](https://www.virustotal.com/gui/file/0e50480e91561fec1724206c20dee85674e70dab4dbba3f6565702e95f932524?nocache=1) Is this a known problem? Is it expected that something like this might happen? Or are my computers so infected that even my security software has viruses? Or what? ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [September 30, 2026, 8:46pm UTC](https://community.emergingthreats.net/t/possible-malware-found-in-suricata-et-open-rules-files-themselves/3466/2 "2026-09-30T20:46:18Z")
Greetings - the rules file is a benign text file - certain static analysis engines may find detection content literals or byte patterns or regexes within as malicious but they are simply there as detection content and rule logic.