Suricata / ET-open rules · threatengine.sh

Home/Detection rules/Suricata / ET-open

Tool

Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

Using these IDS signatures

Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.

Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.

Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

◈

Rules

50 shown of 48,683

et-open web-application-attack

ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete ASCII

sid 2004616 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS My Datebook SQL Injection Attempt -- diary.php delete UPDATE

sid 2004617 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment SELECT

sid 2004618 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment UNION SELECT

sid 2004619 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment INSERT

sid 2004620 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment DELETE

sid 2004621 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment ASCII

sid 2004622 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Particle Soft Particle Gallery SQL Injection Attempt -- viewimage.php editcomment UPDATE

sid 2004623 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank SELECT

sid 2004624 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UNION SELECT

sid 2004625 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank INSERT

sid 2004626 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank DELETE

sid 2004627 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank ASCII

sid 2004628 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UPDATE

sid 2004629 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id UNION SELECT

sid 2004630 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id INSERT

sid 2004631 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id DELETE

sid 2004632 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id ASCII

sid 2004633 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id UPDATE

sid 2004634 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi SELECT

sid 2004635 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi UNION SELECT

sid 2004636 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi INSERT

sid 2004637 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi DELETE

sid 2004638 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi ASCII

sid 2004639 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Comicsense SQL Injection Attempt -- index.php epi UPDATE

sid 2004640 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id SELECT

sid 2004641 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id UNION SELECT

sid 2004642 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id INSERT

sid 2004643 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id DELETE

sid 2004644 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id ASCII

sid 2004645 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Kartli Alisveris Sistemi SQL Injection Attempt -- news.asp news_id UPDATE

sid 2004646 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id SELECT

sid 2004647 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id UNION SELECT

sid 2004648 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id INSERT

sid 2004649 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id DELETE

sid 2004650 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id ASCII

sid 2004651 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W1L3D4 WEBmarket SQL Injection Attempt -- urunbak.asp id UPDATE

sid 2004652 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php SELECT

sid 2004654 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UNION SELECT

sid 2004655 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php INSERT

sid 2004656 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php DELETE

sid 2004657 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php ASCII

sid 2004658 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Wordpress 2.2 SQL Injection Attempt -- xmlrpc.php UPDATE

sid 2004659 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids SELECT

sid 2004666 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids UNION SELECT

sid 2004667 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids INSERT

sid 2004668 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids DELETE

sid 2004669 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids ASCII

sid 2004670 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- inlinemod.php postids UPDATE

sid 2004671 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewReport.php bug SELECT

sid 2004672 format suricata T1190 ↗

Showing 851-900 of 48,683

Prev 18 Next

SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking

Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Detection rules
D3FEND

Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Ransomware groups
Atomic tests

Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation

Compliance and GRC
Framework mapping
Control assessment
Audit view

Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns

About All capabilities Pricing API docs Privacy policy Terms of service

threatengine.sh