With suricata-update v1.3.6 3/10/2025 -- 10:25:10 - -- This is suricata-update version 1.3.6 (rev: None); Python: 3.13.5 (main, Jun 25 2025, 18:55:22) [GCC 14.2.0] 3/10/2025 -- 10:25:10 - -- Setting configuration value subcommand -> update 3/10/2025 -- 10:25:10 - -- Setting configuration value verbose -> True 3/10/2025 -- 10:25:10 - -- Setting configuration value version -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value show-advanced -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value force -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value url -> [] 3/10/2025 -- 10:25:10 - -- Setting configuration value no-ignore -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value dump-sample-configs -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value etopen -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value no-reload -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value no-merge -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value offline -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value fail -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value now -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value disable -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value enable -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value modify -> False 3/10/2025 -- 10:25:10 - -- Setting configuration value drop -> False 3/10/2025 -- 10:25:10 - -- Found suricata at /bin/suricata 3/10/2025 -- 10:25:10 - -- Using data-directory /var/lib/suricata. 3/10/2025 -- 10:25:10 - -- Looking for /etc/suricata/disable.conf 3/10/2025 -- 10:25:10 - -- Found /etc/suricata/disable.conf 3/10/2025 -- 10:25:10 - -- Using /etc/suricata/disable.conf for disable-conf 3/10/2025 -- 10:25:10 - -- Looking for /etc/suricata/enable.conf 3/10/2025 -- 10:25:10 - -- Found /etc/suricata/enable.conf 3/10/2025 -- 10:25:10 - -- Using /etc/suricata/enable.conf for enable-conf 3/10/2025 -- 10:25:10 - -- Looking for /etc/suricata/drop.conf 3/10/2025 -- 10:25:10 - -- Found /etc/suricata/drop.conf 3/10/2025 -- 10:25:10 - -- Using /etc/suricata/drop.conf for drop-conf 3/10/2025 -- 10:25:10 - -- Looking for /etc/suricata/modify.conf 3/10/2025 -- 10:25:10 - -- Found /etc/suricata/modify.conf 3/10/2025 -- 10:25:10 - -- Using /etc/suricata/modify.conf for modify-conf 3/10/2025 -- 10:25:10 - -- Using Suricata configuration /etc/suricata/suricata.yaml 3/10/2025 -- 10:25:10 - -- Using /usr/share/suricata/rules for Suricata provided rules. 3/10/2025 -- 10:25:10 - -- Found Suricata version 8.0.1 at /bin/suricata. 3/10/2025 -- 10:25:10 - -- Loading /etc/suricata/disable.conf. 3/10/2025 -- 10:25:10 - -- Parsing group matcher: group:stream-events.rules 3/10/2025 -- 10:25:10 - -- Loading /etc/suricata/enable.conf. 3/10/2025 -- 10:25:10 - -- Loading /etc/suricata/modify.conf. 3/10/2025 -- 10:25:10 - -- Loading /etc/suricata/drop.conf. 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:ANSSI 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:checkpoint 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:cisco 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:corelight 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:cylera 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:fingerprint 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:FireEye 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:Juniper 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:Linksys 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:Netgear 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:Orange 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:ProofPoint 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:attempted-dos 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:coin-mining 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:command-and-control 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:denial-of-service 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:domain-c2 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:exploit-kit 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:external-ip-check 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:network-scan 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:successful-dos 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:trojan-activity 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:classtype:web-application-attack 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:CVE 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:gouv.fr 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:mitre_technique_id 3/10/2025 -- 10:25:10 - -- Parsing regex matcher: re:pipedream.net 3/10/2025 -- 10:25:10 - -- Loading /etc/suricata/suricata.yaml 3/10/2025 -- 10:25:10 - -- Disabling rules for protocol pgsql 3/10/2025 -- 10:25:10 - -- Disabling rules for protocol modbus 3/10/2025 -- 10:25:10 - -- Disabling rules for protocol dnp3 3/10/2025 -- 10:25:10 - -- Disabling rules for protocol enip 3/10/2025 -- 10:25:10 - -- Loading source specification file /var/lib/suricata/update/sources/pawpatrules.yaml 3/10/2025 -- 10:25:10 - -- Loading source specification file /var/lib/suricata/update/sources/abuse.ch-urlhaus.yaml 3/10/2025 -- 10:25:10 - -- Loading source specification file /var/lib/suricata/update/sources/abuse.ch-feodotracker.yaml 3/10/2025 -- 10:25:10 - -- Loading source specification file /var/lib/suricata/update/sources/et-open.yaml 3/10/2025 -- 10:25:10 - -- Resolved source pawpatrules to URL https://rules.pawpatrules.fr/suricata/paw-patrules.tar.gz. 3/10/2025 -- 10:25:10 - -- Resolved source abuse.ch/urlhaus to URL https://urlhaus.abuse.ch/downloads/urlhaus_suricata.tar.gz. 3/10/2025 -- 10:25:10 - -- Resolved source abuse.ch/feodotracker to URL https://feodotracker.abuse.ch/downloads/feodotracker.tar.gz. 3/10/2025 -- 10:25:10 - -- Resolved source et/open to URL https://rules.emergingthreats.net/open/suricata-8.0.1/emerging.rules.tar.gz. 3/10/2025 -- 10:25:10 - -- Fetching https://urlhaus.abuse.ch/downloads/urlhaus_suricata.tar.gz. 3/10/2025 -- 10:25:10 - -- Setting HTTP User-Agent to Suricata-Update/1.3.6 (OS: Linux; CPU: x86_64; Python: 3.13.5; Dist: Debian GNU/Linux/13; Suricata: 8.0.1) 100% - 696439/696439 3/10/2025 -- 10:25:11 - -- Done. 3/10/2025 -- 10:25:11 - -- Fetching https://feodotracker.abuse.ch/downloads/feodotracker.tar.gz. 3/10/2025 -- 10:25:11 - -- Setting HTTP User-Agent to Suricata-Update/1.3.6 (OS: Linux; CPU: x86_64; Python: 3.13.5; Dist: Debian GNU/Linux/13; Suricata: 8.0.1) 100% - 549/549 3/10/2025 -- 10:25:11 - -- Done. 3/10/2025 -- 10:25:11 - -- Checking https://rules.emergingthreats.net/open/suricata-8.0.1/emerging.rules.tar.gz.md5. 3/10/2025 -- 10:25:11 - -- Setting HTTP User-Agent to Suricata-Update/1.3.6 (OS: Linux; CPU: x86_64; Python: 3.13.5; Dist: Debian GNU/Linux/13; Suricata: 8.0.1) 3/10/2025 -- 10:25:11 - -- Local checksum=|cb678a564d5856c0f76597c73e18fe7b|; remote checksum=|5b749c4665dab0d04b3c637460b7943e| 3/10/2025 -- 10:25:11 - -- Fetching https://rules.emergingthreats.net/open/suricata-8.0.1/emerging.rules.tar.gz. 3/10/2025 -- 10:25:11 - -- Setting HTTP User-Agent to Suricata-Update/1.3.6 (OS: Linux; CPU: x86_64; Python: 3.13.5; Dist: Debian GNU/Linux/13; Suricata: 8.0.1) 100% - 5099200/5099200 3/10/2025 -- 10:25:12 - -- Done. 3/10/2025 -- 10:25:13 - -- Fetching https://rules.pawpatrules.fr/suricata/paw-patrules.tar.gz. 3/10/2025 -- 10:25:13 - -- Setting HTTP User-Agent to Suricata-Update/1.3.6 (OS: Linux; CPU: x86_64; Python: 3.13.5; Dist: Debian GNU/Linux/13; Suricata: 8.0.1) 100% - 602535/602535 3/10/2025 -- 10:25:13 - -- Done. 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/app-layer-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/decoder-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/dhcp-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/dnp3-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/dns-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/files.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/http2-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/http-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/ipsec-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/kerberos-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/modbus-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/mqtt-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/nfs-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/ntp-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/quic-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/rfb-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/smb-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/smtp-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/ssh-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/stream-events.rules 3/10/2025 -- 10:25:13 - -- Loading distribution rule file /usr/share/suricata/rules/tls-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/app-layer-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/decoder-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/dhcp-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/dnp3-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/dns-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/files.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/http-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/http2-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/ipsec-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/kerberos-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/modbus-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/mqtt-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/nfs-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/ntp-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/quic-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/rfb-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/smb-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/smtp-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/ssh-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/stream-events.rules 3/10/2025 -- 10:25:13 - -- Parsing /usr/share/suricata/rules/tls-events.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_AGENT_TESLA_FQDN.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_AGENT_TESLA_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_APT31_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_ASYNCRAT_FQDN.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_ASYNCRAT_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_AZORULT.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_BAZAR_KEGTAP_FQDN.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_BAZAR_KEGTAP_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_BLACKCAT_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_BLACKWORM_RAT_IP.rules 3/10/2025 -- 10:25:13 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_COBALT_STRIKE_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_CRYPTBOT_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_DOPPELPAYMER_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_DRIDEX_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_DRIDEX_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_DRIDEX_URI.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EGREGOR_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EMOTET_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EMOTET_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EVILNUM_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EVILNUM_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_EXPLOIT.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_FIN7_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_FIN7_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_FIN8_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_FINFISHER_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_GMERA_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_GMERA_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_GOZI_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_GRAVITYRAT_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_HAWKEYE_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_HAWKEYE_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LATERAL_MOVEMENT.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LEAKS.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LIMERAT_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LOCKBIT_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LOCKEAN_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LOCKEAN_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LOG4SHELL_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_LOKI_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MALWARES.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MATA_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MATA_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MAZE_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MAZE_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MEKOTIO_USER_AGENT.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_MISC.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NANOCORE_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NANOCORE_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NJRAT_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NJRAT_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NOBELIUM_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_NOBELIUM_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_PHISHING.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_QAKBOT_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_RAGNARLOCKER_IP.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_REVENGE_FQDN.rules 3/10/2025 -- 10:25:14 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_REVIL_SODINOKIBI_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_REVIL_SODINOKIBI_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_REVIL_SODINOKIBI_TLS.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_RYUK_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_RYUK_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SDBBOT_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SDBBOT_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SEKHMET_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SILENCE_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SPALAX_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_SPECIAL_DOMAIN_EXTENSIONS.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TA505_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TA505_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TA551_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TERRALOADER_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TRICKBOT_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TRICKBOT_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_TRICKBOT_URI.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_UNC1878_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_UNC1878_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_UNC2447_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_UNC2447_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_VADOKRIST_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_VULN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_WANNACRY_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_WANNACRY_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_WANNAMINE_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_WANNAMINE_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_XDSPY_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_ZLOADER_FQDN.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_ZLOADER_IP.rules 3/10/2025 -- 10:25:15 - -- Parsing 0d24534050aaf2021175379aba13eeb3/rules/PAW-PATRULES_ZLOADER_URI.rules 3/10/2025 -- 10:25:15 - -- Parsing 4957b48725f05dd2b17ad979082ae355/feodotracker.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/botcc.portgrouped.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/botcc.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/ciarmy.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/compromised.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/drop.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/dshield.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-activex.rules 3/10/2025 -- 10:25:15 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-adware_pup.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-attack_response.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-chat.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-coinminer.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-current_events.rules 3/10/2025 -- 10:25:16 - -- Ignoring file 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-deleted.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-dns.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-dos.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-dyn_dns.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-exploit.rules 3/10/2025 -- 10:25:16 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-exploit_kit.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-file_sharing.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-ftp.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-games.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-hunting.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-icmp.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-imap.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-inappropriate.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-info.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-ja3.rules 3/10/2025 -- 10:25:17 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-malware.rules 3/10/2025 -- 10:25:20 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-misc.rules 3/10/2025 -- 10:25:20 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-mobile_malware.rules 3/10/2025 -- 10:25:20 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-netbios.rules 3/10/2025 -- 10:25:20 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-p2p.rules 3/10/2025 -- 10:25:20 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-phishing.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-pop3.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-remote_access.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-retired.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-rpc.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-scada.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-scan.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-shellcode.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-smtp.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-snmp.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-sql.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-ta_abused_services.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-telnet.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-tftp.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-user_agents.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-voip.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-web_client.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-web_server.rules 3/10/2025 -- 10:25:21 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-web_specific_apps.rules 3/10/2025 -- 10:25:22 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/emerging-worm.rules 3/10/2025 -- 10:25:22 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/threatview_CS_c2.rules 3/10/2025 -- 10:25:22 - -- Parsing 7b26068ce7bef3a8830c5227122c8e0d/rules/tor.rules 3/10/2025 -- 10:25:22 - -- Parsing f7dd9f71b7cbf676a4fe9305ef31f1d4/urlhaus_suricata.rules 3/10/2025 -- 10:25:26 - -- Loaded 113491 rules. 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200073] SURICATA IPv4 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200074] SURICATA TCPv4 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200075] SURICATA UDPv4 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200076] SURICATA ICMPv4 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200077] SURICATA TCPv6 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200078] SURICATA UDPv6 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2200079] SURICATA ICMPv6 invalid checksum 3/10/2025 -- 10:25:26 - -- Disabling: [1:2270000] SURICATA DNP3 Request flood detected 3/10/2025 -- 10:25:26 - -- Disabling: [1:2270001] SURICATA DNP3 Length too small 3/10/2025 -- 10:25:26 - -- Disabling: [1:2270002] SURICATA DNP3 Bad link CRC 3/10/2025 -- 10:25:26 - -- Disabling: [1:2270003] SURICATA DNP3 Bad transport CRC 3/10/2025 -- 10:25:26 - -- Disabling: [1:2270004] SURICATA DNP3 Unknown object 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250001] SURICATA Modbus invalid Protocol version 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250002] SURICATA Modbus unsolicited response 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250003] SURICATA Modbus invalid Length 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250005] SURICATA Modbus invalid Function code 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250006] SURICATA Modbus invalid Value 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250007] SURICATA Modbus Exception code invalid 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250008] SURICATA Modbus Data mismatch 3/10/2025 -- 10:25:26 - -- Disabling: [1:2250009] SURICATA Modbus Request flood detected 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210000] SURICATA STREAM 3way handshake with ack in wrong dir 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210001] SURICATA STREAM 3way handshake async wrong sequence 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210002] SURICATA STREAM 3way handshake right seq wrong ack evasion 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210003] SURICATA STREAM 3way handshake SYNACK in wrong direction 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210004] SURICATA STREAM 3way handshake SYNACK resend with different ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210005] SURICATA STREAM 3way handshake SYNACK resend with different seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210006] SURICATA STREAM 3way handshake SYNACK to server on SYN recv 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210007] SURICATA STREAM 3way handshake SYNACK with wrong ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210055] SURICATA STREAM 3way handshake excessive different SYN/ACKs 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210064] SURICATA STREAM 3way handshake SYN/ACK ignored TFO data 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210063] SURICATA STREAM 3way handshake excessive different SYNs 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210008] SURICATA STREAM 3way handshake SYN resend different seq on SYN recv 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210009] SURICATA STREAM 3way handshake SYN to client on SYN recv 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210010] SURICATA STREAM 3way handshake wrong seq wrong ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210057] SURICATA STREAM 3way handshake toclient data injection suspected 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210011] SURICATA STREAM 4way handshake SYNACK with wrong ACK 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210012] SURICATA STREAM 4way handshake SYNACK with wrong SYN 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210013] SURICATA STREAM 4way handshake wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210014] SURICATA STREAM 4way handshake invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210015] SURICATA STREAM CLOSEWAIT ACK out of window 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210016] SURICATA STREAM CLOSEWAIT FIN out of window 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210017] SURICATA STREAM CLOSEWAIT invalid ACK 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210018] SURICATA STREAM CLOSING ACK wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210019] SURICATA STREAM CLOSING invalid ACK 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210020] SURICATA STREAM ESTABLISHED packet out of window 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210022] SURICATA STREAM ESTABLISHED SYNACK resend 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210023] SURICATA STREAM ESTABLISHED SYNACK resend with different ACK 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210024] SURICATA STREAM ESTABLISHED SYNACK resend with different seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210025] SURICATA STREAM ESTABLISHED SYNACK to server 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210026] SURICATA STREAM ESTABLISHED SYN resend 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210027] SURICATA STREAM ESTABLISHED SYN resend with different seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210028] SURICATA STREAM ESTABLISHED SYN to client 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210029] SURICATA STREAM ESTABLISHED invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210030] SURICATA STREAM FIN invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210031] SURICATA STREAM FIN1 ack with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210032] SURICATA STREAM FIN1 FIN with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210033] SURICATA STREAM FIN1 invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210034] SURICATA STREAM FIN2 ack with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210035] SURICATA STREAM FIN2 FIN with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210036] SURICATA STREAM FIN2 invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210038] SURICATA STREAM FIN out of window 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210039] SURICATA STREAM Last ACK with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210040] SURICATA STREAM Last ACK invalid ACK 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210042] SURICATA STREAM TIMEWAIT ACK with wrong seq 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210043] SURICATA STREAM TIMEWAIT invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210044] SURICATA STREAM Packet with invalid timestamp 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210045] SURICATA STREAM Packet with invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210046] SURICATA STREAM SHUTDOWN RST invalid ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210050] SURICATA STREAM reassembly overlap with different data 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210056] SURICATA STREAM bad window update 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210058] SURICATA STREAM suspected RST injection 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210021] SURICATA STREAM ESTABLISHED retransmission packet before last ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210052] SURICATA STREAM CLOSEWAIT retransmission packet before last ack 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210047] SURICATA STREAM reassembly segment before base seq (retransmission) 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210053] SURICATA STREAM Packet is retransmission 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210054] SURICATA STREAM excessive retransmissions 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210059] SURICATA STREAM pkt seen on wrong thread 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210060] SURICATA STREAM FIN SYN reuse 3/10/2025 -- 10:25:26 - -- Disabling: [1:2210066] SURICATA STREAM urgent OOB limit reached 3/10/2025 -- 10:25:30 - -- Disabling: [1:3300337] 🐾 - ⚠ FTP password ➡ sended in clear text 👀 - Leak 🚱 3/10/2025 -- 10:25:30 - -- Disabling: [1:3300338] 🐾 - ⚠ FTP password ➡ sended in clear text 👀 - Leak 🚱 3/10/2025 -- 10:25:30 - -- Disabling: [1:3300410] 🐾 - ⚠ DNS Request 🌐 - pcloud.com - File Sharing solution 🗃 - Possible Leak 🚱 3/10/2025 -- 10:25:30 - -- Disabling: [1:3300414] 🐾 - ⚠ DNS Request 🌐 - dropbox.com - File Sharing solution 🗃 - Possible Leak 🚱 3/10/2025 -- 10:25:30 - -- Disabling: [1:3300493] 🐾 - ⚠ DNS Request 🌐 - onedrive.live.com - Data Sharing solution 🗃 - Possible Leak 🚱 3/10/2025 -- 10:25:33 - -- Disabling: [1:3312667] 🐾 - ☠ DNS Request 🌐 to suspicious domain - possible DHL phishing 🎣 3/10/2025 -- 10:25:35 - -- Disabling: [1:3300997] 🐾 - 👁 DNS request 🌐 to .xxx 👯🔞 extension 3/10/2025 -- 10:25:35 - -- Disabling: [1:3301003] 🐾 - 👁 DNS request 🌐 to .one ➊ extension 3/10/2025 -- 10:25:35 - -- Disabling: [1:3301007] 🐾 - 👁 DNS request 🌐 to .hk 🇭🇰 extension 3/10/2025 -- 10:25:35 - -- Disabling: [1:3301020] 🐾 - 👁 DNS request 🌐 to .fit 🤸 extension 3/10/2025 -- 10:25:36 - -- Disabling: [1:3317444] 🐾 - 🚨 Outgoing connection to an IP address seen in 🔒 Conti Ransomware Leak 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300149] 🐾 - 🚨 MDNS protocol 🤕 in use - Multicast query observed 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300153] 🐾 - 🚨 MDNS for TCP service 🤕 in use - Multicast query observed 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300154] 🐾 - 🚨 MDNS for UDP service 🤕 in use - Multicast query observed 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300164] 🐾 - 🚨 APT package management 🐧 TLSv1.3 3/10/2025 -- 10:25:38 - -- Disabling: [1:3301102] 🐾 - 🚨 Powershell 🌐 (Windows 🪟) - TLSv1.2 connection to FQDN 3/10/2025 -- 10:25:38 - -- Disabling: [1:3301086] 🐾 - 🚨 Powershell 🌐 (Windows 11 🪟) - TLSv1.2 connection to FQDN 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300246] 🐾 - 🚨 TLS1.0 💔 connection observerd 3/10/2025 -- 10:25:38 - -- Disabling: [1:3300303] 🐾 - 🚨 Suspicious 👀 HTTP trafic on unusual HTTP port 3/10/2025 -- 10:25:40 - -- Enabling: # [1:2027759] ET DNS Query for .co TLD 3/10/2025 -- 10:25:50 - -- Disabling: [1:2027177] ET INFO Command Shell Activity Over SMB - Possible Lateral Movement 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2019982] ET INFO DNS Query to .onion proxy Domain (way2tor) 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2020125] ET INFO DNS Query to .onion proxy Domain (tor4life.com) 3/10/2025 -- 10:25:50 - -- Disabling: [1:2013504] ET INFO GNU/Linux APT User-Agent Outbound likely related to package management 3/10/2025 -- 10:25:50 - -- Disabling: [1:2030518] ET INFO HTTP POST Request to Suspicious *.ma Domain 3/10/2025 -- 10:25:50 - -- Disabling: [1:2012522] ET INFO DNS Query For XXX Adult Site Top Level Domain 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2029834] ET INFO Observed DNS Query to KnowBe4 Simulated Phish Domain 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2011407] ET INFO DNS Query for Suspicious .com.ru Domain 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2011408] ET INFO DNS Query for Suspicious .com.cn Domain 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2011411] ET INFO DNS Query for Suspicious .co.kr Domain 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2027865] ET INFO Observed DNS Query to .cloud TLD 3/10/2025 -- 10:25:50 - -- Enabling: # [1:2027874] ET INFO HTTP Request to Suspicious *.cloud Domain 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2045780] ET INFO Observed DNS Query to .win TLD 3/10/2025 -- 10:25:51 - -- Disabling: [1:2050127] ET INFO DNS Query to Online Application Hosting Domain (onrender .com) 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2014508] ET INFO DNS Query to a *.slyip.net Dynamic DNS Domain 3/10/2025 -- 10:25:51 - -- Disabling: [1:2050736] ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com) 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2012321] ET INFO HTTP Request to a *.cx.cc domain 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2027872] ET INFO HTTP Request to Suspicious *.biz Domain 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2023873] ET INFO DNS Query to Hamas Terrorist Propaganda TV Channel (aqsatv .ps) 3/10/2025 -- 10:25:51 - -- Disabling: [1:2030205] ET INFO HTTP Request for ISO File Direct to IP 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2015576] ET INFO DNS Query to .onion proxy Domain (tor2web) 3/10/2025 -- 10:25:51 - -- Enabling: # [1:2018876] ET INFO DNS Query to .onion proxy Domain (onion.cab) 3/10/2025 -- 10:25:51 - -- Disabling: [1:2056212] ET INFO Internet Printing Protocol (IPP) Get-Printer-Attributes Outbound Request 3/10/2025 -- 10:25:53 - -- Enabling: # [1:2053723] ET INFO DYNAMIC_DNS Query to a *.dyndns-at-home .com Domain 3/10/2025 -- 10:25:53 - -- Enabling: # [1:2053724] ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns-at-home .com Domain 3/10/2025 -- 10:25:53 - -- Disabling: [1:2063117] ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net) 3/10/2025 -- 10:26:44 - -- Disabled 107 rules. 3/10/2025 -- 10:26:44 - -- Enabled 18 rules. 3/10/2025 -- 10:26:44 - -- Modified 6 rules. 3/10/2025 -- 10:26:44 - -- Dropped 103893 rules. 3/10/2025 -- 10:26:44 - -- Checking flowbits for pass 1 of rules. 3/10/2025 -- 10:26:44 - -- Found 380 required flowbits. 3/10/2025 -- 10:26:44 - -- Found 136 rules to enable for flowbit requirements (pass 1) 3/10/2025 -- 10:26:44 - -- Checking flowbits for pass 2 of rules. 3/10/2025 -- 10:26:44 - -- Found 381 required flowbits. 3/10/2025 -- 10:26:45 - -- Found 0 rules to enable for flowbit requirements (pass 2) 3/10/2025 -- 10:26:45 - -- All required rules enabled. 3/10/2025 -- 10:26:45 - -- Enabled 136 rules for flowbit dependencies. 3/10/2025 -- 10:26:45 - -- Backing up current rules. 3/10/2025 -- 10:26:45 - -- Recording existing file /var/lib/suricata/rules/suricata.rules with hash '928e0194ecfffac77111e160f412980b'. 3/10/2025 -- 10:27:00 - -- Writing rules to /var/lib/suricata/rules/suricata.rules: total: 113491; enabled: 97618; added: 11; removed 0; modified: 7945 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_red_flag_domains.lst to /var/lib/suricata/rules/datasets/789a2b835a8844296efb9a037523d3bf 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_red_flag_domains.lst to /var/lib/suricata/rules/datasets/789a2b835a8844296efb9a037523d3bf 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_red_flag_domains.lst to /var/lib/suricata/rules/datasets/789a2b835a8844296efb9a037523d3bf 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_openphish.lst to /var/lib/suricata/rules/datasets/3e6c5358aa5d6f6d3a0887e3b4cd0814 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_openphish.lst to /var/lib/suricata/rules/datasets/3e6c5358aa5d6f6d3a0887e3b4cd0814 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_openphish.lst to /var/lib/suricata/rules/datasets/3e6c5358aa5d6f6d3a0887e3b4cd0814 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_phishstats.lst to /var/lib/suricata/rules/datasets/eeab26fc22636fd972976e118d196f8f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_phishstats.lst to /var/lib/suricata/rules/datasets/eeab26fc22636fd972976e118d196f8f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_phishstats.lst to /var/lib/suricata/rules/datasets/eeab26fc22636fd972976e118d196f8f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_nrd_phishing_14day.lst to /var/lib/suricata/rules/datasets/34c3ba3122e512820052a1f2ba1e6c2f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_nrd_phishing_14day.lst to /var/lib/suricata/rules/datasets/34c3ba3122e512820052a1f2ba1e6c2f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_nrd_phishing_14day.lst to /var/lib/suricata/rules/datasets/34c3ba3122e512820052a1f2ba1e6c2f 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_chrome_l.lst to /var/lib/suricata/rules/datasets/8bbcff8e1b540c8e20b65d20a44a3252 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_chrome_w.lst to /var/lib/suricata/rules/datasets/ea8ac6bf247f409e8ef8a0abd07cdf37 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_chrome_w32.lst to /var/lib/suricata/rules/datasets/1cfec84d82bdb0d4c44ce4767a79f211 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_chrome_m.lst to /var/lib/suricata/rules/datasets/fc7f1bf3299c2df56456a195f07f08f9 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_firefox_w.lst to /var/lib/suricata/rules/datasets/ebc5c6abfc73569a2a3778803b538738 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_firefox_l.lst to /var/lib/suricata/rules/datasets/60f0a25e6ae1dd3376b68840cc16ce22 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_firefox_m.lst to /var/lib/suricata/rules/datasets/fa6b492d74837057bddce3ca8bdb1774 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_thunderbird_w.lst to /var/lib/suricata/rules/datasets/7525eeb78c73dadb502f26e6d435ce80 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_thunderbird_l.lst to /var/lib/suricata/rules/datasets/d7fa85b0bbb522ff2fe857ff25e0ba78 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_thunderbird_m.lst to /var/lib/suricata/rules/datasets/aba47376d20c6b1c9aa9daf84942c31c 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_edge_w.lst to /var/lib/suricata/rules/datasets/adcf3efb23307665b749424ab64825fc 3/10/2025 -- 10:27:00 - -- Copying dataset file pawpatrules_putty.lst to /var/lib/suricata/rules/datasets/e01ec07296517c72dae5443f651dc1e3 Traceback (most recent call last): File "/bin/suricata-update", line 36, in sys.exit(main.main()) ~~~~~~~~~^^ File "/usr/lib/suricata/python/suricata/update/main.py", line 1428, in main sys.exit(_main()) ~~~~~^^ File "/usr/lib/suricata/python/suricata/update/main.py", line 1356, in _main write_merged(os.path.join(output_filename), rulemap, dep_files) ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/suricata/python/suricata/update/main.py", line 573, in write_merged reformatted = handle_dataset_files(rule, dep_files) File "/usr/lib/suricata/python/suricata/update/main.py", line 469, in handle_dataset_files prefix = os.path.dirname(rule.group) File "", line 178, in dirname TypeError: expected str, bytes or os.PathLike object, not NoneType root@iNetSrv01:~#