Home/Detection rules/Suricata / ET-open
Tool
Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

Rules

50 shown of 48,683
sid 2004515 format suricata T1190 ↗
sid 2004521 format suricata T1190 ↗
sid 2004529 format suricata T1190 ↗
sid 2004531 format suricata T1190 ↗
sid 2004532 format suricata T1190 ↗
sid 2004533 format suricata T1190 ↗
sid 2004534 format suricata T1190 ↗
sid 2004547 format suricata T1190 ↗
sid 2004548 format suricata T1190 ↗
sid 2004549 format suricata T1190 ↗
sid 2004550 format suricata T1190 ↗
sid 2004551 format suricata T1190 ↗
sid 2004612 format suricata T1190 ↗
sid 2004614 format suricata T1190 ↗
sid 2004615 format suricata T1190 ↗
Showing 801-850 of 48,683