full-disclosure - [FD] SigInt-Hombre v1 / dynamic Suricata detection rules from real-time threat feeds

Open Source and information security mailing list archives

Message-ID: <CAAHK0WQVrF5g03p=1+x9cNWpghBuU2sFtGV-qViO4h_X=mHdew@mail.gmail.com>
Date: Mon, 5 Jan 2026 23:20:59 -0500
From: malvuln <malvuln13@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] SigInt-Hombre v1 / dynamic Suricata detection rules from
 real-time threat feeds

SigInt-Hombre, generates derived Suricata detection rules from live
URLhaus threat indicators at runtime and deploy them to the Security
Onion platform for high-coverage real-time network monitoring.

https://github.com/malvuln/sigint-hombre

What it does:
Pulls the public URLhaus feed in real time (not mirrored or redistributed)

Skips:
Comments, empty lines, malformed URLs, and feed self-references
Normalizes and extracts:

Protocol, host, URI path, and port
Deduplicates hosts into consistent rule keys

Generates original, derived Suricata alerts for 3 layers:
HTTP → host + URI path, any port if none is specified (max coverage)
TLS → HTTPS detection via SNI (tls.sni) only
DNS → domain lookup visibility via dns.query

Deduplication logic:
HTTP → (host, path)
HTTPS/TLS → host
DNS → host

Writes all alerts into a single combined rule file
Restarts Suricata rules (so-suricata-restart --force)

Malvuln
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives