# \#etopen **URL:** https://community.emergingthreats.net/tag/etopen/18.md [Latest](https://community.emergingthreats.net/latest.md) · [Categories](https://community.emergingthreats.net/categories.md) · [Tags](https://community.emergingthreats.net/tags.md) --- ## [SIGS: PackClient stream-aware signatures and Core startup correlation](https://community.emergingthreats.net/t/sigs-packclient-stream-aware-signatures-and-core-startup-correlation/3461)
**Author:** [@Ivan](https://community.emergingthreats.net/u/Ivan)\ **Replies:** 6\ **Last updated:** [October 1, 2026, 9:53pm UTC](https://community.emergingthreats.net/t/sigs-packclient-stream-aware-signatures-and-core-startup-correlation/3461 "2026-10-01T21:53:58Z")
Hi y’all, I REd PackClient and identified a TCP stream robustness issue in the existing ET PackClient Launcher signatures. The current PLH1 / PLC1 / PLA1 / PLK1 detections (ET SIDs 2069878–2069882) rely on packet-bound… --- ## [Possible malware found in Suricata ET Open rules files themselves!](https://community.emergingthreats.net/t/possible-malware-found-in-suricata-et-open-rules-files-themselves/3466)
**Author:** [@Uyakon](https://community.emergingthreats.net/u/Uyakon)\ **Replies:** 1\ **Last updated:** [September 30, 2026, 8:46pm UTC](https://community.emergingthreats.net/t/possible-malware-found-in-suricata-et-open-rules-files-themselves/3466 "2026-09-30T20:46:18Z")
Hi. I have a rather odd problem. When I scan my computers for viruses, the Suricata rules file itself is flagged as containing malware! So is the update file from EmergingThreats Open. ClamAV flags these files when conf… --- ## [Why ET rules used hex bytes instead of the original characters?](https://community.emergingthreats.net/t/why-et-rules-used-hex-bytes-instead-of-the-original-characters/3423)
**Author:** [@Sam\_Freeman](https://community.emergingthreats.net/u/Sam_Freeman)\ **Replies:** 4\ **Last updated:** [August 24, 2026, 8:09am UTC](https://community.emergingthreats.net/t/why-et-rules-used-hex-bytes-instead-of-the-original-characters/3423 "2026-08-24T08:09:51Z")
Hello everyone! While studying the rules from Emerging Threats, I noticed one peculiarity. In the rules, instead of the original symbols (for example, “.”) their hexadecimal byte values are used. Example Rules: alert… --- ## [SIG:ET HUNTING Possible Sliver Age and Minisign Key Material in Internal TCP Stream](https://community.emergingthreats.net/t/sig-et-hunting-possible-sliver-age-and-minisign-key-material-in-internal-tcp-stream/3352)
**Author:** [@Pb-22](https://community.emergingthreats.net/u/Pb-22)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 2:21am UTC](https://community.emergingthreats.net/t/sig-et-hunting-possible-sliver-age-and-minisign-key-material-in-internal-tcp-stream/3352 "2026-06-10T02:21:20Z")
SIG: ET HUNTING Possible Sliver Age and Minisign Key Material in Internal TCP Stream Hi all, I wanted to share a Suricata hunting rule and an anonymized proof PCAP for review. The rule looks for age style public key mat… --- ## [SIG: EarthWorm Reverse SOCKS Handshake and Tunnel Sequence Detection](https://community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314)
**Author:** [@Pb-22](https://community.emergingthreats.net/u/Pb-22)\ **Replies:** 6\ **Last updated:** [May 27, 2026, 12:42am UTC](https://community.emergingthreats.net/t/sig-earthworm-reverse-socks-handshake-and-tunnel-sequence-detection/3314 "2026-05-27T00:42:18Z")
EarthWorm Research Lineage, Protocol Grounding, and Sample PCAP Set Hi all, I wanted to share some background on how this research thread came together, the protocol grounding behind the detections, and the sample PCAP s… --- ## [SIG: BPFDoor icmpShell ICMP artifacts from Rapid7 whitepaper](https://community.emergingthreats.net/t/sig-bpfdoor-icmpshell-icmp-artifacts-from-rapid7-whitepaper/3271)
**Author:** [@Pb-22](https://community.emergingthreats.net/u/Pb-22)\ **Replies:** 12\ **Last updated:** [May 14, 2026, 8:50pm UTC](https://community.emergingthreats.net/t/sig-bpfdoor-icmpshell-icmp-artifacts-from-rapid7-whitepaper/3271 "2026-05-14T20:50:08Z")
@bingohotdog I put together a small BPFDoor ICMP lab and wanted to share a few tested rule ideas based on a recent Rapid7 whitepaper (link in rules). I built a minimal PCAP to exercise the icmpShell related behaviors de… --- ## [SIG: Suspicious File Delivery from Cloudflare Family Host](https://community.emergingthreats.net/t/sig-suspicious-file-delivery-from-cloudflare-family-host/3246)
**Author:** [@Pb-22](https://community.emergingthreats.net/u/Pb-22)\ **Replies:** 7\ **Last updated:** [April 10, 2026, 5:40pm UTC](https://community.emergingthreats.net/t/sig-suspicious-file-delivery-from-cloudflare-family-host/3246 "2026-04-10T17:40:55Z")
alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“LOCAL suspicious file delivery from targeted Cloudflare-family host”; flow:to\_server,established; http.host; pcre:“/^(?:(?:\[A-Za-z0-9-\]+.)\*trycloudflare.com|(?:\[A-Za-z0-… --- ## [SIGS: PoC for Axios NPM package supply chain compromise](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248)
**Author:** [@n0pth](https://community.emergingthreats.net/u/n0pth)\ **Replies:** 3\ **Last updated:** [April 1, 2026, 9:47pm UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248 "2026-04-01T21:47:19Z")
Signature proposal based on the following research One of the most popular JavaScript packages on earth Axios has been compromised | OpenSourceMalware (disclaimer: i’m not the author). NOTE: Signature SIDs need proper a… --- ## [Bug in emerging-ciarmy.rules?](https://community.emergingthreats.net/t/bug-in-emerging-ciarmy-rules/3124)
**Author:** [@mgjk](https://community.emergingthreats.net/u/mgjk)\ **Replies:** 4\ **Last updated:** [December 4, 2025, 9:37pm UTC](https://community.emergingthreats.net/t/bug-in-emerging-ciarmy-rules/3124 "2025-12-04T21:37:50Z")
I downloaded the latest ruleset and I’m comparing it with the master list https://cinsscore.com/list/ci-badguys.txt. The master list contains 15,000 addresses (they say they capped the list to 15,000), But what’s weird… --- ## [False family: renaming rules from Lumma stealer to GCleaner loader](https://community.emergingthreats.net/t/false-family-renaming-rules-from-lumma-stealer-to-gcleaner-loader/3012)
**Author:** [@naumovax](https://community.emergingthreats.net/u/naumovax)\ **Replies:** 1\ **Last updated:** [September 8, 2025, 3:39pm UTC](https://community.emergingthreats.net/t/false-family-renaming-rules-from-lumma-stealer-to-gcleaner-loader/3012 "2025-09-08T15:39:15Z")
Hello! Our network malware detection team from PT found interesting falses in these Lumma rules: sid: 2064237 rev: 1 ET MALWARE Lumma Stealer CnC Checkin (/info) sid: 2064238 rev: 1 ET MALWARE Lumma Stealer CnC Server … --- ## [ET MALWARE Specter Insight Beacon CnC Checkin; sid: 2061025](https://community.emergingthreats.net/t/et-malware-specter-insight-beacon-cnc-checkin-sid-2061025/2623)
**Author:** [@emankekin](https://community.emergingthreats.net/u/emankekin)\ **Replies:** 2\ **Last updated:** [April 14, 2025, 4:29pm UTC](https://community.emergingthreats.net/t/et-malware-specter-insight-beacon-cnc-checkin-sid-2061025/2623 "2025-04-14T16:29:26Z")
Hello, ET team, found some SpecterInsight traffic, where sid 2061025 does not fire. The rule: alert http $HOME\_NET any -\> $EXTERNAL\_NET any (msg:"ET MALWARE Specter Insight Beacon CnC Checkin"; flow:established,to\_ser… --- ## [PCRE in Sitecore CMS CSRFTOKEN Deserialization sid:2061119 for CVE-2019-9874](https://community.emergingthreats.net/t/pcre-in-sitecore-cms-csrftoken-deserialization-sid-2061119-for-cve-2019-9874/2575)
**Author:** [@rampage](https://community.emergingthreats.net/u/rampage)\ **Replies:** 1\ **Last updated:** [March 27, 2025, 6:28pm UTC](https://community.emergingthreats.net/t/pcre-in-sitecore-cms-csrftoken-deserialization-sid-2061119-for-cve-2019-9874/2575 "2025-03-27T18:28:45Z")
Hi, Friends! The PoC payload snippet disclosed in https://www.synacktiv.com/ressources/advisories/Sitecore\_CSRF\_deserialize\_RCE.pdf is a base64 encoded string. “\_\_CSRFTOKEN=/wEysRIAAQAAAP////8BAAAAAAAAAAwCAAAASVN5c3Rlb… --- ## [When loading rules for SID 2060960, 2060961, the message 'fast\_pattern is ineffective with base64\_data' occurs](https://community.emergingthreats.net/t/when-loading-rules-for-sid-2060960-2060961-the-message-fast-pattern-is-ineffective-with-base64-data-occurs/2562)
**Author:** [@won2852](https://community.emergingthreats.net/u/won2852)\ **Replies:** 1\ **Last updated:** [March 25, 2025, 4:51pm UTC](https://community.emergingthreats.net/t/when-loading-rules-for-sid-2060960-2060961-the-message-fast-pattern-is-ineffective-with-base64-data-occurs/2562 "2025-03-25T16:51:23Z")
When loading rules for SIDs 2060960, 2060961, it throws the message ‘fast\_pattern is ineffective with base64\_data’. alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET WEB\_SPECIFIC\_APPS xml-crypto / Node.js SAML Authe… --- ## [ET WEB\_SERVER Next.js CVE-2025-29927 middleware bypass attempt](https://community.emergingthreats.net/t/et-web-server-next-js-cve-2025-29927-middleware-bypass-attempt/2553)
**Author:** [@0xThiebaut](https://community.emergingthreats.net/u/0xThiebaut)\ **Replies:** 1\ **Last updated:** [March 24, 2025, 8:36pm UTC](https://community.emergingthreats.net/t/et-web-server-next-js-cve-2025-29927-middleware-bypass-attempt/2553 "2025-03-24T20:36:05Z")
In reference to CVE-2025-29927: alert http any any -\> $HTTP\_SERVERS any (msg: "ET WEB\_SERVER Next.js CVE-2025-29927 middleware bypass attempt"; flow: established, to\_server; http.header\_names; content: "|0d 0a|x-middle… --- ## [Zyxel runCommandInShell Telnet Service - rule id 2060323](https://community.emergingthreats.net/t/zyxel-runcommandinshell-telnet-service-rule-id-2060323/2475)
**Author:** [@jhemmer](https://community.emergingthreats.net/u/jhemmer)\ **Replies:** 0\ **Last updated:** [February 25, 2025, 4:42pm UTC](https://community.emergingthreats.net/t/zyxel-runcommandinshell-telnet-service-rule-id-2060323/2475 "2025-02-25T16:42:14Z")
I find the pcre section on this rule suspect… It appears that the regex is looking for zero to unlimited occurrences of many things. But basically just matches on content:sh Can someone please review? --- ## [Sid:2055984 Ivanti Cloud Service Appliance Authenticated Command Injection (CVE-2024-8190)](https://community.emergingthreats.net/t/sid-2055984-ivanti-cloud-service-appliance-authenticated-command-injection-cve-2024-8190/2011)
**Author:** [@rampage](https://community.emergingthreats.net/u/rampage)\ **Replies:** 1\ **Last updated:** [October 1, 2024, 7:57pm UTC](https://community.emergingthreats.net/t/sid-2055984-ivanti-cloud-service-appliance-authenticated-command-injection-cve-2024-8190/2011 "2024-10-01T19:57:05Z")
Greetings friends! sid:2055984 references www.horizon3.ai/attack-research/cisa-kev-cve-2024-8190-ivanti-csa-command-injection/, however it is not alerting on POST requests produced by the POC (GitHub - horizon3ai/CVE-20… --- ## [PigButcher Credential Phish Landing Page Rules Error on Suricata 7](https://community.emergingthreats.net/t/pigbutcher-credential-phish-landing-page-rules-error-on-suricata-7/1939)
**Author:** [@ar3s](https://community.emergingthreats.net/u/ar3s)\ **Replies:** 6\ **Last updated:** [September 9, 2024, 5:33pm UTC](https://community.emergingthreats.net/t/pigbutcher-credential-phish-landing-page-rules-error-on-suricata-7/1939 "2024-09-09T17:33:46Z")
Hi All, 3 Rules from \[Ruleset Update Summary - 2024/08/28 - v10676\] are causing errors on suricata version 7 due to http\_content\_type misplacement. sid:2055541 sid:2055542 sid:2055543 Current rule: alert http $EXTE… --- ## [NMAP ruleset are FP?](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945)
**Author:** [@jul10l1r43](https://community.emergingthreats.net/u/jul10l1r43)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 12:59pm UTC](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945 "2024-09-05T12:59:33Z")
Does anyone know why several rules that identified portscan were removed? 2009582 for example # alert tcp $EXTERNAL\_NET any -\> $HOME\_NET any (msg:"ET SCAN NMAP -sS window 1024"; fragbits:!D; dsize:0; flags:S,12; ack:0; … --- ## [DiamotrixClipper](https://community.emergingthreats.net/t/diamotrixclipper/1925)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 2\ **Last updated:** [August 30, 2024, 9:08pm UTC](https://community.emergingthreats.net/t/diamotrixclipper/1925 "2024-08-30T21:08:33Z")
Hi, together with @g0njxa we found a loader(Sniffthem/Tnaket) and a clipper (Diamotrix) here is the signature for the clipper: URI: alert http any any -\> any any (msg: "ET MALWARE \[ANY.RUN\] Request a wallet for Diamo… --- ## [NjRAT variant - tXRAT v.2.3R](https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 1\ **Last updated:** [June 21, 2024, 4:44pm UTC](https://community.emergingthreats.net/t/njrat-variant-txrat-v-2-3r/1746 "2024-06-21T16:44:11Z")
Hi, recently I discovered a modification of the famous rat NjRat, we could not detect it with the existing rules, so I propose several new ones (version obtained from traffic) NjRat Traffic example 155.ll|‘|’|VEVTVF9D… --- ## [ET MALWARE Generic Request to gate.php Dotted-Quad - Rule ID 2022986](https://community.emergingthreats.net/t/et-malware-generic-request-to-gate-php-dotted-quad-rule-id-2022986/1330)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 1\ **Last updated:** [January 29, 2024, 9:59pm UTC](https://community.emergingthreats.net/t/et-malware-generic-request-to-gate-php-dotted-quad-rule-id-2022986/1330 "2024-01-29T21:59:59Z")
hi team Emerging Threats… hope this email finds you well… appreciate if can advise the URL on which this rule is built on as i need to understand its CVSS and gain more insight into this signature… also can if possibl… --- ## [IDS and IPS rules on LAN](https://community.emergingthreats.net/t/ids-and-ips-rules-on-lan/1300)
**Author:** [@hacked](https://community.emergingthreats.net/u/hacked)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 6:05pm UTC](https://community.emergingthreats.net/t/ids-and-ips-rules-on-lan/1300 "2024-01-22T18:05:41Z")
Hi, I’m interesting to do IDS and IPS on the inside of my network using Suricata. I have trouble of as an exampe of detecting nmap scans and having a look at the example rule below: alert tcp $EXTERNAL\_NET any → $HOME\_… --- ## [Independant System Verification and Validation of Malware](https://community.emergingthreats.net/t/independant-system-verification-and-validation-of-malware/1238)
**Author:** [@prime69](https://community.emergingthreats.net/u/prime69)\ **Replies:** 2\ **Last updated:** [December 28, 2023, 9:32pm UTC](https://community.emergingthreats.net/t/independant-system-verification-and-validation-of-malware/1238 "2023-12-28T21:32:08Z")
hi Team Emerging Threats hope this message finds you well… can please advise why alerts on Security onion written by emerging threat does not trigger alerts on other platforms such as AV and malware byte as when i rec… --- ## [Addressing an FP: 2016950 - ET MALWARE Possible Win32/Hupigon ip.txt with a Non-Mozilla UA](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003)
**Author:** [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\ **Replies:** 0\ **Last updated:** [October 2, 2023, 3:35pm UTC](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003 "2023-10-02T15:35:54Z")
A customer recently reported some False Positives on a signature and it made for an interesting case to track down. The report mentioned that 2016950 was trigging on benign HTTP traffic and was actually one of “Top 5” s… --- ## [Possible FP - JA3 Hash - \[Abuse.ch\] Possible Adware](https://community.emergingthreats.net/t/possible-fp-ja3-hash-abuse-ch-possible-adware/825)
**Author:** [@erenhelm](https://community.emergingthreats.net/u/erenhelm)\ **Replies:** 1\ **Last updated:** [August 1, 2023, 6:53pm UTC](https://community.emergingthreats.net/t/possible-fp-ja3-hash-abuse-ch-possible-adware/825 "2023-08-01T18:53:25Z")
We are receiving alerts on this: alert tls $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET JA3 Hash - \[Abuse.ch\] Possible Adware”; ja3\_hash; content:“bc6c386f480ee97b9d9e52d472b772d8”; reference:url,sslbl.abuse.ch/ja3-finger… --- ## [Possible FP: ET JA3 Hash - \[Abuse.ch\] Possible Adwind](https://community.emergingthreats.net/t/possible-fp-et-ja3-hash-abuse-ch-possible-adwind/732)
**Author:** [@bigjohns97](https://community.emergingthreats.net/u/bigjohns97)\ **Replies:** 3\ **Last updated:** [July 14, 2023, 12:28pm UTC](https://community.emergingthreats.net/t/possible-fp-et-ja3-hash-abuse-ch-possible-adwind/732 "2023-07-14T12:28:57Z")
Getting a False Positive alert on the following rule. alert tls $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET JA3 Hash - \[Abuse.ch\] Possible Adwind”; ja3\_hash; content:“d2935c58fe676744fecc8614ee5356c7”; reference:url,sslb… --- ## [Possible FP: ET MALWARE Sourtoff Receiving Simda Payload](https://community.emergingthreats.net/t/possible-fp-et-malware-sourtoff-receiving-simda-payload/736)
**Author:** [@bigjohns97](https://community.emergingthreats.net/u/bigjohns97)\ **Replies:** 4\ **Last updated:** [July 7, 2023, 11:21pm UTC](https://community.emergingthreats.net/t/possible-fp-et-malware-sourtoff-receiving-simda-payload/736 "2023-07-07T23:21:51Z")
Had this alert come up today and while there was a download of data there wasn’t any malicious malware detected (MS defender) so I am wondering if this md5 hash isn’t accurate? alert tcp $EXTERNAL\_NET 20000: → $HOME\_NET… --- ## [GoodMorning Ransomware](https://community.emergingthreats.net/t/goodmorning-ransomware/586)
**Author:** [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Replies:** 7\ **Last updated:** [June 23, 2023, 2:42pm UTC](https://community.emergingthreats.net/t/goodmorning-ransomware/586 "2023-06-23T14:42:13Z")
I would like to suggest you the rules from any.run. Is it okay if the name is their name? I just have them now. Link to sample: where it sends one GET request. Exfiltration was not found, perhaps it is in the encoded… --- ## [Licensing: Is the Compromised-IPs list also 'Open'?](https://community.emergingthreats.net/t/licensing-is-the-compromised-ips-list-also-open/676)
**Author:** [@DeFranzl](https://community.emergingthreats.net/u/DeFranzl)\ **Replies:** 1\ **Last updated:** [June 20, 2023, 2:27pm UTC](https://community.emergingthreats.net/t/licensing-is-the-compromised-ips-list-also-open/676 "2023-06-20T14:27:02Z")
Hi. To me it’s not really clear if the compromised-ips.txt file below is in the Open-Package, or if it’s Pro. https://rules.emergingthreats.net/blockrules/compromised-ips.txt Is there any overview which list belongs t… --- ## [New Signature: MalDoc/Gamaredon CnC Activity](https://community.emergingthreats.net/t/new-signature-maldoc-gamaredon-cnc-activity/575)
**Author:** [@kevross33](https://community.emergingthreats.net/u/kevross33)\ **Replies:** 1\ **Last updated:** [May 19, 2023, 10:45pm UTC](https://community.emergingthreats.net/t/new-signature-maldoc-gamaredon-cnc-activity/575 "2023-05-19T22:45:47Z")
alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:““MalDoc/Gamaredon CnC Activity”; flow:established,to\_server; content:“OPTIONS”; http\_method; content:”/USER-"; http\_uri; depth:6; fast\_pattern; content:“Microsoft Offic… [Next page](https://community.emergingthreats.net/tag/etopen/18.md?match_all_tags=true&page=1&tags%5B%5D=etopen)