Tool
Network IDS
Suricata / ET-open
6,432 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.
◈
Rules
50 shown of 6,432
et-open
bad-unknown
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
et-open
bad-unknown
ET INFO WinUpack Modified PE Header Inbound
et-open
bad-unknown
ET INFO WinUpack Modified PE Header Outbound
et-open
bad-unknown
ET HUNTING Double User-Agent (User-Agent User-Agent)
et-open
bad-unknown
ET USER_AGENTS Suspicious User-Agent (HTTP_CONNECT_)
et-open
bad-unknown
ET USER_AGENTS User-Agent (Internet Explorer)
et-open
bad-unknown
ET POLICY Proxy TRACE Request - inbound
et-open
bad-unknown
ET MALWARE Incorrectly formatted User-Agent string (dashes instead of semicolons) Likely Hostile
et-open
bad-unknown
ET SCAN Suspicious inbound to MSSQL port 1433
et-open
bad-unknown
ET SCAN Suspicious inbound to Oracle SQL port 1521
et-open
bad-unknown
ET SCAN Suspicious inbound to mySQL port 3306
et-open
bad-unknown
ET SCAN Suspicious inbound to PostgreSQL port 5432
et-open
bad-unknown
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
et-open
bad-unknown
ET WEB_CLIENT PDF Containing Windows Commands Downloaded
et-open
bad-unknown
ET WEB_CLIENT Likely Malicious PDF Containing StrReverse
et-open
bad-unknown
ET WEB_CLIENT FakeAV scanner page encountered Initializing Virus Protection System
et-open
bad-unknown
ET POLICY HTTP Request to a *.co.cc domain
et-open
bad-unknown
ET POLICY HTTP Request to a *.cz.cc domain
et-open
bad-unknown
ET HUNTING Abnormal User-Agent No space after colon - Likely Hostile
et-open
bad-unknown
ET DNS DNS Lookup for localhost.DOMAIN.TLD
et-open
bad-unknown
ET HUNTING Zero Content-Length HTTP POST with data (outbound)
et-open
bad-unknown
ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode
Showing 1-50 of 6,432