urlhaus-filter (Suricata)

Von /
von Ming Di Leom Malware Regex
https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-suricata-online.rules Rohliste öffnen
24,1kEinträge
+21,7k -21,7kletzte Änderung
zuletzt aktualisiert
8,3 MBGröße
vor 24 Stundenzuletzt geprüft

Beschreibung

Filterliste aus den Bereichen Malware. Betreut von Ming Di Leom. Einzelheiten und Aufnahmekriterien stehen auf der Projektseite.

Integration

Add the list to the blocking.denylists section of your config.yml:

blocking:
  denylists:
    default:
      - https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-suricata-online.rules
  clientGroupsBlock:
    default:
      - default

Restart Blocky afterwards.

Blocky Dokumentation

Letzte Änderungen

Kürzlich hinzugefügte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.62.87.116"; classtype:trojan-activity; sid:100000001 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.101.221"; classtype:trojan-activity; sid:100000002 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.136.152"; classtype:trojan-activity; sid:100000003 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.94.221.183"; classtype:trojan-activity; sid:100000004 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.95.51.146"; classtype:trojan-activity; sid:100000005 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.126.11.168"; classtype:trojan-activity; sid:100000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.193.211"; classtype:trojan-activity; sid:100000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.220.118"; classtype:trojan-activity; sid:100000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.23.121.201"; classtype:trojan-activity; sid:100000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.35.56.7"; classtype:trojan-activity; sid:100000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.43.49.183"; classtype:trojan-activity; sid:100000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.142"; classtype:trojan-activity; sid:100000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.223"; classtype:trojan-activity; sid:100000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.93"; classtype:trojan-activity; sid:100000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.161.39"; classtype:trojan-activity; sid:100000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.23.89.5"; classtype:trojan-activity; sid:100000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.53.15.18"; classtype:trojan-activity; sid:100000020 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.68.74.45"; classtype:trojan-activity; sid:100000021 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.101.81.142"; classtype:trojan-activity; sid:100000022 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.106.250.161"; classtype:trojan-activity; sid:100000023 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.116.190.93"; classtype:trojan-activity; sid:100000024 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.163.10"; classtype:trojan-activity; sid:100000025 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.174.116"; classtype:trojan-activity; sid:100000026 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.126.201.130"; classtype:trojan-activity; sid:100000027 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.159.152.118"; classtype:trojan-activity; sid:100000028 rev:1;)

Kürzlich entfernte Einträge

  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.101.221"; classtype:trojan-activity; sid:100000001 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.92.136.152"; classtype:trojan-activity; sid:100000002 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.94.221.183"; classtype:trojan-activity; sid:100000003 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"1.95.51.146"; classtype:trojan-activity; sid:100000004 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.126.11.168"; classtype:trojan-activity; sid:100000005 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.193.211"; classtype:trojan-activity; sid:100000006 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.200.220.118"; classtype:trojan-activity; sid:100000007 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.23.121.201"; classtype:trojan-activity; sid:100000008 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.35.56.7"; classtype:trojan-activity; sid:100000009 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.43.49.183"; classtype:trojan-activity; sid:100000010 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"101.59.79.119"; classtype:trojan-activity; sid:100000011 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.160.93"; classtype:trojan-activity; sid:100000015 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.161.39"; classtype:trojan-activity; sid:100000016 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.220.163.170"; classtype:trojan-activity; sid:100000017 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.23.89.5"; classtype:trojan-activity; sid:100000018 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.53.15.18"; classtype:trojan-activity; sid:100000019 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"102.68.74.45"; classtype:trojan-activity; sid:100000020 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.101.81.142"; classtype:trojan-activity; sid:100000021 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.101.85.165"; classtype:trojan-activity; sid:100000022 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.101.85.173"; classtype:trojan-activity; sid:100000023 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.106.250.161"; classtype:trojan-activity; sid:100000024 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.116.190.93"; classtype:trojan-activity; sid:100000025 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.125.163.10"; classtype:trojan-activity; sid:100000026 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.163.119.220"; classtype:trojan-activity; sid:100000027 rev:1;)
  • alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"urlhaus-filter malicious website detected"; flow:established,from_client; http.method; content:"GET"; http.host; content:"103.164.117.74"; classtype:trojan-activity; sid:100000028 rev:1;)
Nach oben scrollen