From 4e7fc6c9f87632131d4d093aeffd677b52a31944 Mon Sep 17 00:00:00 2001
From: root <root@wazuh.ccicm.lan>
Date: Wed, 18 Feb 2026 07:55:29 +0100
Subject: [PATCH] prout

---
 Suricata.xml | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/Suricata.xml b/Suricata.xml
index 2973770..d708501 100644
--- a/Suricata.xml
+++ b/Suricata.xml
@@ -352,22 +352,11 @@
 
 
 
-<!-- Exception métier : Sphinx exécuté depuis SMB -->
-<group name="ids,suricata">
-  <rule id="100602" level="0">
-    <if_sid>100600</if_sid>
-    <regex type="pcre2" field="smb.filename">(?i)Systeme.*\.exe</regex>
-    <description>
-      Suricata: Known business software (Sphinx) executed from SMB share
-    </description>
-    <options>no_full_log</options>
-  </rule>
-</group>
 
 <!-- Alertes critic : Executable file - Autre que fichier lambda -->
 <group name="ids, suricata">
     <rule id="100603" level="12">
-        <if_sid>100600</if_sid>
+        <if_sid>100601</if_sid>
         <regex type="pcre2" negate="yes" field="smb.filename">(?i)\.(pdf|docx?|xlsx?|pptx?|txt|jpe?g|png|gif|csv|zip|rar)</regex>
         <description>Suricata: Fichier executable dans dossier partagé</description>
         <!-- <options>no_full_log</options> -->