Suricata / ET-open rules · threatengine.sh

Tool

Network IDS

Suricata / ET-open

278 rules · network intrusion-detection signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

◈

Rules

50 shown of 278

et-open attempted-recon

ET SCAN Potential SSH Scan

sid 2001219 format suricata

et-open attempted-recon

ET SCAN Nessus User Agent

sid 2002664 format suricata

et-open attempted-recon

ET POLICY Possible Web Crawl using Wget

sid 2002823 format suricata

et-open attempted-recon

ET POLICY POSSIBLE Web Crawl using Curl

sid 2002825 format suricata

et-open attempted-recon

ET POLICY POSSIBLE Crawl using Fetch

sid 2002827 format suricata

et-open attempted-recon

ET SCAN Potential VNC Scan 5800-5820

sid 2002910 format suricata

et-open attempted-recon

ET POLICY Possible Web Crawl - libwww-perl User Agent

sid 2002935 format suricata

et-open attempted-recon

ET POLICY python.urllib User Agent Web Crawl

sid 2002943 format suricata

et-open attempted-recon

ET SCAN Potential SSH Scan OUTBOUND

sid 2003068 format suricata

et-open attempted-recon

ET SCAN IBM NSA User Agent

sid 2003171 format suricata

et-open attempted-recon

ET SCAN w3af User Agent

sid 2007757 format suricata

et-open attempted-recon

ET SCAN Internal to Internal UPnP Request tcp port 2555

sid 2008092 format suricata

et-open attempted-recon

ET SCAN External to Internal UPnP Request tcp port 2555

sid 2008093 format suricata

et-open attempted-recon

ET SCAN External to Internal UPnP Request udp port 1900

sid 2008094 format suricata

et-open attempted-recon

ET SCAN Paros Proxy Scanner Detected

sid 2008187 format suricata

et-open attempted-recon

ET SCAN Watchfire AppScan Web App Vulnerability Scanner

sid 2008311 format suricata

et-open attempted-recon

ET SCAN DEBUG Method Request with Command

sid 2008312 format suricata

et-open attempted-recon

ET SCAN Cisco Torch TFTP Scan

sid 2008414 format suricata

et-open attempted-recon

ET SCAN Cisco Torch IOS HTTP Scan

sid 2008415 format suricata

et-open attempted-recon

ET SCAN Httprint Web Server Fingerprint Scan

sid 2008416 format suricata

et-open attempted-recon

ET SCAN Wapiti Web Server Vulnerability Scan

sid 2008417 format suricata

et-open attempted-recon

ET SCAN Smap VOIP Device Scan

sid 2008526 format suricata

et-open attempted-recon

ET SCAN Hmap Webserver Fingerprint Scan

sid 2008537 format suricata

et-open attempted-recon

ET SCAN Sqlmap SQL Injection Scan

sid 2008538 format suricata T1190 ↗

et-open attempted-recon

ET SCAN Voiper Toolkit Torturer Scan

sid 2008568 format suricata

et-open attempted-recon

ET SCAN Acunetix Version 6 Crawl/Scan Detected

sid 2008571 format suricata

et-open attempted-recon

ET SCAN Voiper Fuzzing Scan

sid 2008577 format suricata

et-open attempted-recon

ET SCAN Sipvicious Scan

sid 2008578 format suricata

et-open attempted-recon

ET SCAN Sipp SIP Stress Test Detected

sid 2008579 format suricata

et-open attempted-recon

ET SCAN Sipsak SIP scan

sid 2008598 format suricata

et-open attempted-recon

ET SCAN Stompy Web Application Session Scan

sid 2008605 format suricata

et-open attempted-recon

ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan

sid 2008606 format suricata

et-open attempted-recon

ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan

sid 2008609 format suricata

et-open attempted-recon

ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan

sid 2008610 format suricata

et-open attempted-recon

ET SCAN Wikto Scan

sid 2008617 format suricata

et-open attempted-recon

ET SCAN Httprecon Web Server Fingerprint Scan

sid 2008627 format suricata

et-open attempted-recon

ET SCAN WSFuzzer Web Application Fuzzing

sid 2008628 format suricata

et-open attempted-recon

ET SCAN Wikto Backend Data Miner Scan

sid 2008629 format suricata

et-open attempted-recon

ET SCAN SIP erase_registrations/add registrations attempt

sid 2008640 format suricata

et-open attempted-recon

ET SCAN sipscan probe

sid 2008641 format suricata

et-open attempted-recon

ET SCAN SQLix SQL Injection Vector Scan

sid 2008654 format suricata T1190 ↗

et-open attempted-recon

ET SCAN Mini MySqlatOr SQL Injection Scanner

sid 2008729 format suricata T1190 ↗

et-open attempted-recon

ET POLICY IP Check whatismyip.com Automation Page

sid 2008985 format suricata

et-open attempted-recon

ET POLICY IP Check Domain (whatismyip in HTTP Host)

sid 2008986 format suricata

et-open attempted-recon

ET POLICY IP Check Domain (showip in HTTP Host)

sid 2008987 format suricata

et-open attempted-recon

ET POLICY IP Check Domain (cmyip.com in HTTP Host)

sid 2008988 format suricata

et-open attempted-recon

ET POLICY IP Check Domain (showmyip in HTTP Host)

sid 2008989 format suricata

et-open attempted-recon

ET POLICY IP Check Domain (whatismyip in HTTP Host)

sid 2009020 format suricata

et-open attempted-recon

ET SCAN SQLNinja MSSQL Version Scan

sid 2009038 format suricata

et-open attempted-recon

ET SCAN SQLNinja MSSQL XPCmdShell Scan

sid 2009039 format suricata

Showing 1-50 of 278

Prev 1 Next