{{suricata_blacklistmd5_action}} http {{suricata_blacklistmd5_src}} {{suricata_blacklistmd5_src_port}} -> {{suricata_blacklistmd5_dst}} {{suricata_blacklistmd5_dst_port}} (msg:"{{suricata_blacklistmd5_msg}}"; filemd5:fileblacklist.md5; filestore:both; classtype:suspicious-filename-detect; sid:{{suricata_blacklistmd5_sid}}; rev:{{suricata_blacklistmd5_rev}};)
{{suricata_blacklistsha1_action}} http {{suricata_blacklistsha1_src}} {{suricata_blacklistsha1_src_port}} -> {{suricata_blacklistsha1_dst}} {{suricata_blacklistsha1_dst_port}} (msg:"{{suricata_blacklistsha1_msg}}"; filesha1:fileblacklist.sha1; filestore:both; classtype:suspicious-filename-detect; sid:{{suricata_blacklistsha1_sid}}; rev:{{suricata_blacklistsha1_rev}};)
{{suricata_blacklistsha256_action}} http {{suricata_blacklistsha256_src}} {{suricata_blacklistsha256_src_port}} -> {{suricata_blacklistsha256_dst}} {{suricata_blacklistsha256_dst_port}} (msg:"{{suricata_blacklistsha256_msg}}"; filesha256:fileblacklist.sha256; filestore:both; classtype:suspicious-filename-detect; sid:{{suricata_blacklistsha256_sid}}; rev:{{suricata_blacklistsha256_rev}};)

