diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs
index 1e8e3c2f96..67097e5edb 100644
--- a/rust/sys/src/sys.rs
+++ b/rust/sys/src/sys.rs
@@ -25,6 +25,7 @@ pub const SIGMATCH_STATEFUL: u32 = 8388608;
 pub const SIGMATCH_INFO_BITFLAGS_UINT: u32 = 1048576;
 pub const SIGMATCH_BAN_FIREWALL_RULE: u32 = 2097152;
 pub const SIGMATCH_BAN_FIREWALL_MODE: u32 = 4194304;
+pub const SIGMATCH_BAN_TD_FIREWALL_MODE: u32 = 16777216;
 pub type __intmax_t = ::std::os::raw::c_long;
 pub type intmax_t = __intmax_t;
 #[repr(u32)]
diff --git a/src/detect-engine-register.c b/src/detect-engine-register.c
index fa1a226c88..0c94152a10 100644
--- a/src/detect-engine-register.c
+++ b/src/detect-engine-register.c
@@ -341,6 +341,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("not supported in firewall mode");
         prev = 1;
     }
+    if (flags & SIGMATCH_BAN_TD_FIREWALL_MODE) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("not supported in threat detection rules in firewall mode");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);
diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h
index c02e93b337..8a247f3600 100644
--- a/src/detect-engine-register.h
+++ b/src/detect-engine-register.h
@@ -360,6 +360,8 @@ extern int DETECT_TBLSIZE_IDX;
 #define SIGMATCH_BAN_FIREWALL_RULE (1UL << (21))
 /** keyword cannot be used in firewall mode */
 #define SIGMATCH_BAN_FIREWALL_MODE (1UL << (22))
+/** keyword cannot be used in td rules with firewall mode */
+#define SIGMATCH_BAN_TD_FIREWALL_MODE (1UL << (24))
 
 int SigTableList(const char *keyword);
 void SigTableCleanup(void);
diff --git a/src/detect-parse.c b/src/detect-parse.c
index 3df0c1b6ab..d79642ffd0 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -1015,6 +1015,13 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
         goto error;
     }
 
+    /* For non-firewall rules */
+    if (EngineModeIsFirewall() && !s->init_data->firewall_rule &&
+            (st->flags & SIGMATCH_BAN_TD_FIREWALL_MODE) != 0) {
+        SCLogError("keyword \'%s\' is not supported in threat detection rules with firewall mode",
+                optname);
+        goto error;
+    }
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */