Home/Detection rules/Suricata / ET-open
Tool
Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

Rules

50 shown of 48,683
sid 2004913 format suricata T1190 ↗
sid 2004914 format suricata T1190 ↗
sid 2004915 format suricata T1190 ↗
sid 2004916 format suricata T1190 ↗
sid 2004930 format suricata T1190 ↗
sid 2004931 format suricata T1190 ↗
sid 2004932 format suricata T1190 ↗
sid 2004933 format suricata T1190 ↗
sid 2004934 format suricata T1190 ↗
sid 2004935 format suricata T1190 ↗
sid 2004962 format suricata T1190 ↗
sid 2004967 format suricata T1190 ↗
sid 2004969 format suricata T1190 ↗
Showing 1101-1150 of 48,683