Network IDS rules

Home/Network IDS rules

IDS / IPS

240 rules · linked to T1102 · Snort / Suricata signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. Expand a rule to view its source link.

◈

Rules

50 shown of 240

et-open misc-activity

ET INFO DNS Query for Webhook/HTTP Request Inspection Service (saucelabs .com)

sid 2047733 format suricata

et-open misc-activity

ET INFO Webhook/HTTP Request Inspection Service Domain (requestinspector .com in TLS SNI)

sid 2049157 format suricata

et-open misc-activity

ET INFO Abused File Hosting Domain (uploadnow .io) in DNS Lookup

sid 2060806 format suricata

et-open misc-activity

ET INFO Abused File Sharing Domain (uploadnow .io) in TLS SNI

sid 2060807 format suricata

et-open misc-activity

ET INFO Observed URL Shortener Service (tr .ee) in DNS Lookup

sid 2060808 format suricata

et-open misc-activity

ET INFO Observed URL Shortener Service Domain (tr .ee) in TLS SNI

sid 2060809 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (noritter .com) in DNS Lookup

sid 2060836 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (deliveryoka .com) in DNS Lookup

sid 2060837 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (security-confirmation .help) in DNS Lookup

sid 2060838 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (id .kickfire .com) in DNS Lookup

sid 2060840 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (tapestryoftruth .com) in DNS Lookup

sid 2060841 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (noritter .com) in TLS SNI

sid 2060842 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (deliveryoka .com) in TLS SNI

sid 2060843 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (security-confirmation .help) in TLS SNI

sid 2060844 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (id .kickfire .com) in TLS SNI

sid 2060846 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (tapestryoftruth .com) in TLS SNI

sid 2060847 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (main-connection .click) in DNS Lookup

sid 2060848 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (authentication-to .help) in DNS Lookup

sid 2060849 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (open-connect-to-cdn .cc) in DNS Lookup

sid 2060850 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (connection .click) in DNS Lookup

sid 2060851 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (westmaidentrue .click) in DNS Lookup

sid 2060852 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (main-connection .click) in TLS SNI

sid 2060863 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (authentication-to .help) in TLS SNI

sid 2060864 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (open-connect-to-cdn .cc) in TLS SNI

sid 2060865 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (connection .click) in TLS SNI

sid 2060866 format suricata

et-open trojan-activity

ET EXPLOIT_KIT Observed ClickFix Domain (westmaidentrue .click) in TLS SNI

sid 2060867 format suricata

et-open misc-activity

ET INFO Zoho Social URL Shortener Service CnC Domain in DNS Lookup (zurl .co)

sid 2060952 format suricata

et-open trojan-activity

ET MALWARE VKeylogger Payload Delivery Domain (lenovo-sync .com) in DNS Lookup

sid 2062155 format suricata

et-open trojan-activity

ET MALWARE Observed VKeylogger Payload Delivery Domain (lenovo-sync .com) in TLS SNI

sid 2062156 format suricata

et-open trojan-activity

ET HUNTING Dotted Quad Host Workzueg HTTP Server String Response

sid 2063017 format suricata

et-open misc-activity

ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net)

sid 2063117 format suricata

et-open misc-activity

ET INFO Abused Hosting Domain (azurewebsites .net) in TLS SNI

sid 2063118 format suricata

et-open trojan-activity

ET MALWARE KimJongRAT CnC Checkin

sid 2063163 format suricata

et-open misc-activity

ET INFO FileSharing Service in DNS Lookup (icedrive .net)

sid 2063174 format suricata

et-open misc-activity

ET INFO FileSharing Service in DNS Lookup (koofr .net)

sid 2063175 format suricata

et-open misc-activity

ET INFO FileSharing Service in DNS Lookup (koofr .eu)

sid 2063176 format suricata

et-open misc-activity

ET INFO Observed FileSharing Service Domain (icedrive .net) in TLS SNI

sid 2063177 format suricata

et-open misc-activity

ET INFO Observed FileSharing Service Domain (koofr .net) in TLS SNI

sid 2063178 format suricata

et-open misc-activity

ET INFO Observed FileSharing Service Domain (koofr .eu) in TLS SNI

sid 2063179 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector Rungan Backdoor Access M1

sid 2064391 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector Rungan Backdoor Access M2

sid 2064392 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector Rungan Backdoor Access M3

sid 2064393 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector Rungan Backdoor Access M4

sid 2064394 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector CnC Domain in DNS Lookup (868id .com)

sid 2064395 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector CnC Domain in DNS Lookup (822th .com)

sid 2064396 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector CnC Domain in DNS Lookup (cs01 .shop)

sid 2064397 format suricata

et-open trojan-activity

ET MALWARE GhostRedirector CnC Domain in DNS Lookup (881vn .com)

sid 2064398 format suricata

et-open trojan-activity

ET MALWARE Observed GhostRedirector Domain (868id .com) in TLS SNI

sid 2064399 format suricata

et-open trojan-activity

ET MALWARE Observed GhostRedirector Domain (822th .com) in TLS SNI

sid 2064400 format suricata

et-open trojan-activity

ET MALWARE Observed GhostRedirector Domain (cs01 .shop) in TLS SNI

sid 2064401 format suricata

Showing 1-50 of 240

Prev 1 Next

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin