Home/Detection rules/Suricata / ET-open
Tool
Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

Rules

50 shown of 48,683
et-open trojan-activity
sid 2004442 format suricata
sid 2004450 format suricata T1190 ↗
sid 2004451 format suricata T1190 ↗
sid 2004452 format suricata T1190 ↗
sid 2004453 format suricata T1190 ↗
sid 2004454 format suricata T1190 ↗
sid 2004455 format suricata T1190 ↗
sid 2004456 format suricata T1190 ↗
sid 2004457 format suricata T1190 ↗
sid 2004458 format suricata T1190 ↗
sid 2004459 format suricata T1190 ↗
sid 2004460 format suricata T1190 ↗
sid 2004461 format suricata T1190 ↗
sid 2004493 format suricata T1190 ↗
sid 2004495 format suricata T1190 ↗
sid 2004496 format suricata T1190 ↗
sid 2004497 format suricata T1190 ↗
sid 2004498 format suricata T1190 ↗
sid 2004503 format suricata T1190 ↗
sid 2004505 format suricata T1190 ↗
sid 2004507 format suricata T1190 ↗
sid 2004508 format suricata T1190 ↗
sid 2004509 format suricata T1190 ↗
sid 2004510 format suricata T1190 ↗
Showing 751-800 of 48,683