Network IDS rules

Home/Network IDS rules

IDS / IPS

1,487 rules · linked to T1189 · Snort / Suricata signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. Expand a rule to view its source link.

◈

Rules

50 shown of 1,487

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in TLS Lookup (happyllfe .online)

sid 2057185 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in DNS Lookup (marketexpert .site)

sid 2057186 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in TLS Lookup (marketexpert .site)

sid 2057187 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in DNS Lookup (metricsy .shop)

sid 2057188 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in TLS Lookup (metricsy .shop)

sid 2057189 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in DNS Lookup (advertls .shop)

sid 2057404 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in TLS Lookup (advertls .shop)

sid 2057405 format suricata

et-open domain-c2

ET MALWARE Win32/SocGholish Domain in DNS Lookup (dashnex .plexusmarket .fund)

sid 2057636 format suricata

et-open domain-c2

ET MALWARE Win32/SocGholish Domain in TLS SNI (dashnex .plexusmarket .fund)

sid 2057637 format suricata

et-open exploit-kit

ET EXPLOIT_KIT CC Skimmer Domain in TLS Lookup (bytesbazar .com)

sid 2057711 format suricata

et-open exploit-kit

ET EXPLOIT_KIT Parrot TDS Domain in DNS Lookup (source .scriptsafedata .com)

sid 2057805 format suricata

et-open exploit-kit

ET EXPLOIT_KIT Parrot TDS Domain in TLS SNI (source .scriptsafedata .com)

sid 2057806 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (devolredir .com)

sid 2057854 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (redircorrectiv .com)

sid 2057855 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (economistjournal .cloud)

sid 2057856 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (journalctd .live)

sid 2057857 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (redirconnectwise .cloud)

sid 2057858 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (1drv .us .com)

sid 2057859 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (cwise .store)

sid 2057860 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (redjournal .cloud)

sid 2057861 format suricata

et-open domain-c2

ET MALWARE RomCom Group Domain in DNS Lookup (correctiv .sbs)

sid 2057862 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (devolredir .com) in TLS SNI

sid 2057863 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (redircorrectiv .com) in TLS SNI

sid 2057864 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (economistjournal .cloud) in TLS SNI

sid 2057865 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (journalctd .live) in TLS SNI

sid 2057866 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (redirconnectwise .cloud) in TLS SNI

sid 2057867 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (1drv .us .com) in TLS SNI

sid 2057868 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (cwise .store) in TLS SNI

sid 2057869 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (redjournal .cloud) in TLS SNI

sid 2057870 format suricata

et-open domain-c2

ET MALWARE Observed RomCom Group Domain (correctiv .sbs) in TLS SNI

sid 2057871 format suricata

et-open trojan-activity

ET WEB_SPECIFIC_APPS SonicWall NetExtender for Windows EPC Client Update RCE Attempt (CVE-2024-29014)

sid 2057880 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (dechromo .com)

sid 2058163 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (dechromo .com)

sid 2058164 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (lamartesana .info)

sid 2058165 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (lamartesana .info)

sid 2058166 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (homeservicephiladelphia .info)

sid 2058183 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (homeservicephiladelphia .info)

sid 2058187 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (enerjjoy .com)

sid 2058188 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (enerjjoy .com)

sid 2058189 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (prajapatisamaj .info)

sid 2058198 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (prajapatisamaj .info)

sid 2058199 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (djnito .com)

sid 2058200 format suricata

et-open exploit-kit

ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (djnito .com)

sid 2058201 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (gxgsxy .info)

sid 2058253 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (nilsenfk .biz)

sid 2058254 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (poucette .info)

sid 2058255 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (gxgsxy .info)

sid 2058256 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (nilsenfk .biz)

sid 2058257 format suricata

et-open exploit-kit

ET EXPLOIT_KIT ZPHP Domain in TLS SNI (poucette .info)

sid 2058258 format suricata

et-open exploit-kit

ET EXPLOIT_KIT Redirect to TOAD Domain in DNS Lookup (ecomicrolab .com)

sid 2058263 format suricata

Showing 51-100 of 1,487

Prev 2 Next

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin