|
SIGS: PackClient stream-aware signatures and Core startup correlation
|
|
6
|
117
|
October 1, 2026
|
|
Possible malware found in Suricata ET Open rules files themselves!
|
|
1
|
74
|
September 30, 2026
|
|
Why ET rules used hex bytes instead of the original characters?
|
|
4
|
125
|
August 24, 2026
|
|
SIG:ET HUNTING Possible Sliver Age and Minisign Key Material in Internal TCP Stream
|
|
0
|
115
|
June 10, 2026
|
|
SIG: EarthWorm Reverse SOCKS Handshake and Tunnel Sequence Detection
|
|
6
|
293
|
May 27, 2026
|
|
SIG: BPFDoor icmpShell ICMP artifacts from Rapid7 whitepaper
|
|
12
|
1144
|
May 14, 2026
|
|
SIG: Suspicious File Delivery from Cloudflare Family Host
|
|
7
|
314
|
April 10, 2026
|
|
SIGS: PoC for Axios NPM package supply chain compromise
|
|
3
|
188
|
April 1, 2026
|
|
Bug in emerging-ciarmy.rules?
|
|
4
|
127
|
December 4, 2025
|
|
False family: renaming rules from Lumma stealer to GCleaner loader
|
|
1
|
152
|
September 8, 2025
|
|
ET MALWARE Specter Insight Beacon CnC Checkin; sid: 2061025
|
|
2
|
263
|
April 14, 2025
|
|
PCRE in Sitecore CMS CSRFTOKEN Deserialization sid:2061119 for CVE-2019-9874
|
|
1
|
190
|
March 27, 2025
|
|
When loading rules for SID 2060960, 2060961, the message 'fast_pattern is ineffective with base64_data' occurs
|
|
1
|
132
|
March 25, 2025
|
|
ET WEB_SERVER Next.js CVE-2025-29927 middleware bypass attempt
|
|
1
|
162
|
March 24, 2025
|
|
Zyxel runCommandInShell Telnet Service - rule id 2060323
|
|
0
|
91
|
February 25, 2025
|
|
Sid:2055984 Ivanti Cloud Service Appliance Authenticated Command Injection (CVE-2024-8190)
|
|
1
|
201
|
October 1, 2024
|
|
PigButcher Credential Phish Landing Page Rules Error on Suricata 7
|
|
6
|
216
|
September 9, 2024
|
|
NMAP ruleset are FP?
|
|
1
|
206
|
September 5, 2024
|
|
DiamotrixClipper
|
|
2
|
384
|
August 30, 2024
|
|
NjRAT variant - tXRAT v.2.3R
|
|
1
|
256
|
June 21, 2024
|
|
ET MALWARE Generic Request to gate.php Dotted-Quad - Rule ID 2022986
|
|
1
|
415
|
January 29, 2024
|
|
IDS and IPS rules on LAN
|
|
1
|
724
|
January 22, 2024
|
|
Independant System Verification and Validation of Malware
|
|
2
|
259
|
December 28, 2023
|
|
Addressing an FP: 2016950 - ET MALWARE Possible Win32/Hupigon ip.txt with a Non-Mozilla UA
|
|
0
|
271
|
October 2, 2023
|
|
Possible FP - JA3 Hash - [Abuse.ch] Possible Adware
|
|
1
|
425
|
August 1, 2023
|
|
Possible FP: ET JA3 Hash - [Abuse.ch] Possible Adwind
|
|
3
|
860
|
July 14, 2023
|
|
Possible FP: ET MALWARE Sourtoff Receiving Simda Payload
|
|
4
|
461
|
July 7, 2023
|
|
GoodMorning Ransomware
|
|
7
|
580
|
June 23, 2023
|
|
Licensing: Is the Compromised-IPs list also 'Open'?
|
|
1
|
435
|
June 20, 2023
|
|
New Signature: MalDoc/Gamaredon CnC Activity
|
|
1
|
252
|
May 19, 2023
|