Suricata / ET-open rules · threatengine.sh

Home/Detection rules/Suricata / ET-open

Tool

Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

Using these IDS signatures

Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.

Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.

Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

◈

Rules

50 shown of 48,683

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album SELECT

sid 2004857 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album UNION SELECT

sid 2004858 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album INSERT

sid 2004859 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album DELETE

sid 2004860 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album ASCII

sid 2004861 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS XLAtunes SQL Injection Attempt -- view.php album UPDATE

sid 2004862 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id SELECT

sid 2004863 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id UNION SELECT

sid 2004864 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id INSERT

sid 2004865 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id DELETE

sid 2004866 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id ASCII

sid 2004867 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Snitz Forums 2000 SQL Injection Attempt -- pop_profile.asp id UPDATE

sid 2004868 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id SELECT

sid 2004869 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id UNION SELECT

sid 2004870 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id INSERT

sid 2004871 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id DELETE

sid 2004872 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id ASCII

sid 2004873 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Turuncu Portal SQL Injection Attempt -- h_goster.asp id UPDATE

sid 2004874 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID SELECT

sid 2004875 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID UNION SELECT

sid 2004876 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID INSERT

sid 2004877 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID DELETE

sid 2004878 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID ASCII

sid 2004879 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CodeAvalanche News SQL Injection Attempt -- inc_listnews.asp CAT_ID UPDATE

sid 2004880 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id SELECT

sid 2004887 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id UNION SELECT

sid 2004888 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id INSERT

sid 2004889 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id DELETE

sid 2004890 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id ASCII

sid 2004891 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- HaberDetay.asp id UPDATE

sid 2004892 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid SELECT

sid 2004893 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid UNION SELECT

sid 2004894 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid INSERT

sid 2004895 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid DELETE

sid 2004896 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid ASCII

sid 2004897 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Aktueldownload Haber script SQL Injection Attempt -- rss.asp kid UPDATE

sid 2004898 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid SELECT

sid 2004899 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid UNION SELECT

sid 2004900 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid INSERT

sid 2004901 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid DELETE

sid 2004902 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid ASCII

sid 2004903 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS phpCC SQL Injection Attempt -- nickpage.php npid UPDATE

sid 2004904 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id SELECT

sid 2004905 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id UNION SELECT

sid 2004906 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id INSERT

sid 2004907 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id DELETE

sid 2004908 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id ASCII

sid 2004909 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PollMentor SQL Injection Attempt -- pollmentorres.asp id UPDATE

sid 2004910 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID SELECT

sid 2004911 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WebTester SQL Injection Attempt -- directions.php testID UNION SELECT

sid 2004912 format suricata T1190 ↗

Showing 1051-1100 of 48,683

Prev 22 Next

SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking

Detection Engineering
Detection coverage workspace
Saved stacks
SIEM query builder
Detection rules
D3FEND

Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Ransomware groups
Atomic tests

Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation

Compliance and GRC
Framework mapping
Control assessment
Audit view

Atlas Search Threat actors Techniques Detection coverage Tools & malware CWE CAPEC KEV catalog Package vulns

About All capabilities Pricing API docs Privacy policy Terms of service

threatengine.sh