Home/Detection rules/Suricata / ET-open
Tool
Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

Rules

50 shown of 48,683
sid 2004816 format suricata T1190 ↗
sid 2004818 format suricata T1190 ↗
sid 2004819 format suricata T1190 ↗
sid 2004820 format suricata T1190 ↗
sid 2004821 format suricata T1190 ↗
sid 2004828 format suricata T1190 ↗
sid 2004830 format suricata T1190 ↗
sid 2004831 format suricata T1190 ↗
sid 2004832 format suricata T1190 ↗
sid 2004833 format suricata T1190 ↗
sid 2004840 format suricata T1190 ↗
sid 2004842 format suricata T1190 ↗
sid 2004843 format suricata T1190 ↗
sid 2004844 format suricata T1190 ↗
sid 2004845 format suricata T1190 ↗
sid 2004855 format suricata T1190 ↗
Showing 1001-1050 of 48,683