[Emerging-Sigs] Issue Disabling SID 2018959

Matthew Clairmont (R* NYC) Matthew.Clairmont at rockstargames.com
Wed Apr 24 12:34:43 HDT 2019


After several hours of playing with this issue, I came across the below comment on the signature describing the exact issue I'm having. When putting 1:2018959 into disabledsid.conf and running pulledpork again, it does not disable the signature, however, I can disable it's reference SID 2000419 (amongst 30+ others) without issue.  Has anyone successfully disabled both of these recently with pulledork v0.7.3 and Suricata 4.1.3?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20190424/a70a71bb/attachment.html>

More information about the Emerging-sigs mailing list