# \#false-positives **URL:** https://community.emergingthreats.net/tag/false-positives/23.md [Latest](https://community.emergingthreats.net/latest.md) · [Categories](https://community.emergingthreats.net/categories.md) · [Tags](https://community.emergingthreats.net/tags.md) --- ## [False positive 2035595 - zgRAT / PureRAT confusion](https://community.emergingthreats.net/t/false-positive-2035595-zgrat-purerat-confusion/3393)
**Author:** [@erik4711](https://community.emergingthreats.net/u/erik4711)\ **Replies:** 5\ **Last updated:** [October 5, 2026, 6:00am UTC](https://community.emergingthreats.net/t/false-positive-2035595-zgrat-purerat-confusion/3393 "2026-10-05T06:00:25Z")
I see rule 2035595 “ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert” getting triggered every now and then, but never for zgRAT traffic. It typically triggers when there’s PureRAT C2 traffic. I think I might have seen it… --- ## [False Positive Report - SID 2049637 (Bitbucket CVE-2022-1471 Vulnerable Server Detected 7.17.x–7.21.15) matches ALL 7.21.x including patched versions](https://community.emergingthreats.net/t/false-positive-report-sid-2049637-bitbucket-cve-2022-1471-vulnerable-server-detected-7-17-x-7-21-15-matches-all-7-21-x-including-patched-versions/3388)
**Author:** [@sonzu](https://community.emergingthreats.net/u/sonzu)\ **Replies:** 1\ **Last updated:** [July 23, 2026, 4:33pm UTC](https://community.emergingthreats.net/t/false-positive-report-sid-2049637-bitbucket-cve-2022-1471-vulnerable-server-detected-7-17-x-7-21-15-matches-all-7-21-x-including-patched-versions/3388 "2026-07-23T16:33:31Z")
Rule (rev 1, 2023-12-12) : drop http \[$HOME\_NET,$HTTP\_SERVERS\] any → any any (msg:“ET WEB\_SPECIFIC\_APPS Atlassian Bitbucket CVE-2022-1471 Vulnerable Server Detected Version 7.17.x - 7.21.15”; flow:established,to\_client;… --- ## [False positive in SID 2067295 (CVE-2025-58180 OctoPrint upload) - pcre matches multipart line terminator](https://community.emergingthreats.net/t/false-positive-in-sid-2067295-cve-2025-58180-octoprint-upload-pcre-matches-multipart-line-terminator/3356)
**Author:** [@pedrolamas](https://community.emergingthreats.net/u/pedrolamas)\ **Replies:** 2\ **Last updated:** [June 15, 2026, 3:15pm UTC](https://community.emergingthreats.net/t/false-positive-in-sid-2067295-cve-2025-58180-octoprint-upload-pcre-matches-multipart-line-terminator/3356 "2026-06-15T15:15:57Z")
This rule fires on any legitimate multipart file upload to /api/files/local, not just command-injection attempts. Root cause In the pcre, the skip class \[^\\x26\]\*? only stops at &, so it walks past the closing " of the f… --- ## [SID 2069172 Alerts on Benign Activity](https://community.emergingthreats.net/t/sid-2069172-alerts-on-benign-activity/3286)
**Author:** [@segers](https://community.emergingthreats.net/u/segers)\ **Replies:** 1\ **Last updated:** [May 8, 2026, 9:26pm UTC](https://community.emergingthreats.net/t/sid-2069172-alerts-on-benign-activity/3286 "2026-05-08T21:26:20Z")
This alerted hundreds of times in our environment, mostly from Windows PCs; all of it appears to be benign. I compared the PCAPs from our alerts to the signature, but I’m not sure what could be changed in the signature. --- ## [False positive for 2067921 ET MALWARE PureLogs Stealer CnC ping Request](https://community.emergingthreats.net/t/false-positive-for-2067921-et-malware-purelogs-stealer-cnc-ping-request/3215)
**Author:** [@grodriguez](https://community.emergingthreats.net/u/grodriguez)\ **Replies:** 2\ **Last updated:** [February 27, 2026, 5:41pm UTC](https://community.emergingthreats.net/t/false-positive-for-2067921-et-malware-purelogs-stealer-cnc-ping-request/3215 "2026-02-27T17:41:20Z")
Hi everyone, We are observing consistent false positives triggered by SID 2067921 (“ET MALWARE PureLogs Stealer CnC ping Request”). The rule is rev 1 and was created yesterday (2026\_02\_25) yet we have already received a… --- ## [Potential False Positive for 2009099 being triggered by Aurora iOS app to AWS IP Addresses](https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209)
**Author:** [@keysox](https://community.emergingthreats.net/u/keysox)\ **Replies:** 1\ **Last updated:** [February 23, 2026, 7:27pm UTC](https://community.emergingthreats.net/t/potential-false-positive-for-2009099-being-triggered-by-aurora-ios-app-to-aws-ip-addresses/3209 "2026-02-23T19:27:55Z")
I am reporting a potential False Positive for SID: 2009099 (ET P2P ThunderNetwork UDP Traffic). This rule is triggering from the My Aurora Forecast & Alerts iOS app. The traffic is directed to qt-houston.bronze.systems (… --- ## [Are Google LLC IPs flagged as malicious really worth investigating?](https://community.emergingthreats.net/t/are-google-llc-ips-flagged-as-malicious-really-worth-investigating/3197)
**Author:** [@DnG](https://community.emergingthreats.net/u/DnG)\ **Replies:** 0\ **Last updated:** [February 15, 2026, 10:40pm UTC](https://community.emergingthreats.net/t/are-google-llc-ips-flagged-as-malicious-really-worth-investigating/3197 "2026-02-15T22:40:36Z")
Came accross 147.185.133.235 a ( Google LLC ) IP flagged by 11 security vendors as malicious on virustotal. Is it worth or its another rabbit hole --- ## [Bug: SID 2064326 has severity:1 but is labeled "ET INFO"](https://community.emergingthreats.net/t/bug-sid-2064326-has-severity-1-but-is-labeled-et-info/3171)
**Author:** [@Hans2026](https://community.emergingthreats.net/u/Hans2026)\ **Replies:** 4\ **Last updated:** [January 21, 2026, 3:33pm UTC](https://community.emergingthreats.net/t/bug-sid-2064326-has-severity-1-but-is-labeled-et-info/3171 "2026-01-21T15:33:05Z")
Rule SID 2064326 “ET INFO Python aiohttp User-Agent Observed Inbound” has conflicting severity indicators, causing false positives in downstream security tools. This rule has: severity: 1 in Suricata alert output (cri… --- ## [2010677 ET MALWARE Suspicious User-Agent (My Session)](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127)
**Author:** [@segers](https://community.emergingthreats.net/u/segers)\ **Replies:** 4\ **Last updated:** [December 5, 2025, 7:00pm UTC](https://community.emergingthreats.net/t/2010677-et-malware-suspicious-user-agent-my-session/3127 "2025-12-05T19:00:49Z")
Alerting on legitimate outbound traffic from Aquaveo software. --- ## [Suricata not detecting attacks using emerging threats](https://community.emergingthreats.net/t/suricata-not-detecting-attacks-using-emerging-threats/3100)
**Author:** [@Karl0Ken](https://community.emergingthreats.net/u/Karl0Ken)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 11:38am UTC](https://community.emergingthreats.net/t/suricata-not-detecting-attacks-using-emerging-threats/3100 "2025-11-04T11:38:20Z")
I am currently working on my thesis, where I need a set of suricata alerts, labeled with event type (benign, attack). For this, I’ve been using the cic-ids2017 data set (https://www.unb.ca/cic/datasets/ids-2017.html). I … --- ## [False Positive 2065016 ET TROJAN BPFDoor Heartbeat (Outbound)](https://community.emergingthreats.net/t/false-positive-2065016-et-trojan-bpfdoor-heartbeat-outbound/3072)
**Author:** [@FastForward2025](https://community.emergingthreats.net/u/FastForward2025)\ **Replies:** 2\ **Last updated:** [October 6, 2025, 4:03pm UTC](https://community.emergingthreats.net/t/false-positive-2065016-et-trojan-bpfdoor-heartbeat-outbound/3072 "2025-10-06T16:03:47Z")
This rule triggered 2025/10/02 - 2025/10/03 on (Amazon) Ring Doorbell and Ring Floodlight devices. I spoke with Ring Customer Service who said the devices were performing a legitimate firmware update. 2065016 - ET TROJA… --- ## [False family: renaming rules from Lumma stealer to GCleaner loader](https://community.emergingthreats.net/t/false-family-renaming-rules-from-lumma-stealer-to-gcleaner-loader/3012)
**Author:** [@naumovax](https://community.emergingthreats.net/u/naumovax)\ **Replies:** 1\ **Last updated:** [September 8, 2025, 3:39pm UTC](https://community.emergingthreats.net/t/false-family-renaming-rules-from-lumma-stealer-to-gcleaner-loader/3012 "2025-09-08T15:39:15Z")
Hello! Our network malware detection team from PT found interesting falses in these Lumma rules: sid: 2064237 rev: 1 ET MALWARE Lumma Stealer CnC Checkin (/info) sid: 2064238 rev: 1 ET MALWARE Lumma Stealer CnC Server … --- ## [Zyxel runCommandInShell Telnet Service - rule id 2060323](https://community.emergingthreats.net/t/zyxel-runcommandinshell-telnet-service-rule-id-2060323/2475)
**Author:** [@jhemmer](https://community.emergingthreats.net/u/jhemmer)\ **Replies:** 0\ **Last updated:** [February 25, 2025, 4:42pm UTC](https://community.emergingthreats.net/t/zyxel-runcommandinshell-telnet-service-rule-id-2060323/2475 "2025-02-25T16:42:14Z")
I find the pcre section on this rule suspect… It appears that the regex is looking for zero to unlimited occurrences of many things. But basically just matches on content:sh Can someone please review? --- ## [NMAP ruleset are FP?](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945)
**Author:** [@jul10l1r43](https://community.emergingthreats.net/u/jul10l1r43)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 12:59pm UTC](https://community.emergingthreats.net/t/nmap-ruleset-are-fp/1945 "2024-09-05T12:59:33Z")
Does anyone know why several rules that identified portscan were removed? 2009582 for example # alert tcp $EXTERNAL\_NET any -\> $HOME\_NET any (msg:"ET SCAN NMAP -sS window 1024"; fragbits:!D; dsize:0; flags:S,12; ack:0; … --- ## [FP on 2856495 - "ETPRO HUNTING If-Unmodified-Since Header with Microsoft BITS User-Agent"](https://community.emergingthreats.net/t/fp-on-2856495-etpro-hunting-if-unmodified-since-header-with-microsoft-bits-user-agent/1511)
**Author:** [@kevin\_branch](https://community.emergingthreats.net/u/kevin_branch)\ **Replies:** 1\ **Last updated:** [March 27, 2024, 5:17pm UTC](https://community.emergingthreats.net/t/fp-on-2856495-etpro-hunting-if-unmodified-since-header-with-microsoft-bits-user-agent/1511 "2024-03-27T17:17:27Z")
Hi, We are getting tons of FP hits on this rule in which the Host: header ends with cdn.office.net. I see we are already excluding other Windows/Microsoft domains and I presume we should add something like this to the … --- ## [SID 2012870 - Outbound Request contains pw](https://community.emergingthreats.net/t/sid-2012870-outbound-request-contains-pw/1218)
**Author:** [@kiwibenis](https://community.emergingthreats.net/u/kiwibenis)\ **Replies:** 2\ **Last updated:** [December 19, 2023, 6:34pm UTC](https://community.emergingthreats.net/t/sid-2012870-outbound-request-contains-pw/1218 "2023-12-19T18:34:22Z")
Hello everyone, since a few days I get alerts on this SID: 2012870 - ET POLICY HTTP Outbound Request contains pw Today the rule for me contains this: alert tcp $HOME\_NET any -\> $EXTERNAL\_NET $HTTP\_PORTS (msg:"ET POLI… --- ## [False positive on Android Trojan](https://community.emergingthreats.net/t/false-positive-on-android-trojan/1053)
**Author:** [@michmoor](https://community.emergingthreats.net/u/michmoor)\ **Replies:** 1\ **Last updated:** [October 19, 2023, 7:34pm UTC](https://community.emergingthreats.net/t/false-positive-on-android-trojan/1053 "2023-10-19T19:34:15Z")
Greetings everyone, Im writing to see what is the best way to report a false positive on a signature. Signature: ET JA3 Hash - Trojan.AndroidOS.Jocker.snt 1 Background: Seeking advice on next steps in investigation | … --- ## [Handling False Positive Reports as A Rule Writer! Special Guests: PCREs, Dalton, Dalton’s Flowsynth](https://community.emergingthreats.net/t/handling-false-positive-reports-as-a-rule-writer-special-guests-pcres-dalton-dalton-s-flowsynth/1031)
**Author:** [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\ **Replies:** 11\ **Last updated:** [October 12, 2023, 7:20pm UTC](https://community.emergingthreats.net/t/handling-false-positive-reports-as-a-rule-writer-special-guests-pcres-dalton-dalton-s-flowsynth/1031 "2023-10-12T19:20:12Z")
Hi All, This post reviews how you may want to troubleshoot False Positive alerts from a Suricata Rule. If you already have an established troubleshooting flow, then I suggest you stick around for the later discussion ab… --- ## [Addressing an FP: 2016950 - ET MALWARE Possible Win32/Hupigon ip.txt with a Non-Mozilla UA](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003)
**Author:** [@bmurphy](https://community.emergingthreats.net/u/bmurphy)\ **Replies:** 0\ **Last updated:** [October 2, 2023, 3:35pm UTC](https://community.emergingthreats.net/t/addressing-an-fp-2016950-et-malware-possible-win32-hupigon-ip-txt-with-a-non-mozilla-ua/1003 "2023-10-02T15:35:54Z")
A customer recently reported some False Positives on a signature and it made for an interesting case to track down. The report mentioned that 2016950 was trigging on benign HTTP traffic and was actually one of “Top 5” s…