Suricata / ET-open rules · threatengine.sh

Home/Detection rules/Suricata / ET-open

Tool

Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

Using these IDS signatures

Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.

Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.

Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

◈

Rules

50 shown of 48,683

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php from UPDATE

sid 2005128 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q SELECT

sid 2005129 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q UNION SELECT

sid 2005130 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q INSERT

sid 2005131 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q DELETE

sid 2005132 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q ASCII

sid 2005133 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS X-dev xNews SQL Injection Attempt -- class.news.php q UPDATE

sid 2005134 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid SELECT

sid 2005141 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid UNION SELECT

sid 2005142 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid INSERT

sid 2005143 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid DELETE

sid 2005144 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid ASCII

sid 2005145 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Martyn Kilbryde Newsposter Script SQL Injection Attempt -- news_page.asp uid UPDATE

sid 2005146 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user UNION SELECT

sid 2005147 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user INSERT

sid 2005148 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user DELETE

sid 2005149 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user ASCII

sid 2005150 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user UPDATE

sid 2005151 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines SELECT

sid 2005152 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines UNION SELECT

sid 2005153 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines DELETE

sid 2005154 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines INSERT

sid 2005155 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines ASCII

sid 2005156 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS SpoonLabs Vivvo Article Management CMS (phpWordPress) SQL Injection Attempt -- show_webfeed.php wcHeadlines UPDATE

sid 2005157 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id SELECT

sid 2005158 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id UNION SELECT

sid 2005159 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id INSERT

sid 2005160 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id DELETE

sid 2005161 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id ASCII

sid 2005162 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS xNews SQL Injection Attempt -- xNews.php id UPDATE

sid 2005163 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id SELECT

sid 2005164 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id UNION SELECT

sid 2005165 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id INSERT

sid 2005166 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id DELETE

sid 2005167 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id ASCII

sid 2005168 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP NEWS SQL Injection Attempt -- news_detail.asp id UPDATE

sid 2005169 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user SELECT

sid 2005170 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user UNION SELECT

sid 2005171 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user INSERT

sid 2005172 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user DELETE

sid 2005173 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user ASCII

sid 2005174 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ASP EDGE SQL Injection Attempt -- user.asp user UPDATE

sid 2005175 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Forum Livre SQL Injection Attempt -- info_user.asp user SELECT

sid 2005176 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS AJ Forum SQL Injection Attempt -- topic_title.php td_id UNION SELECT

sid 2005177 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Hunkaray Okul Portaly SQL Injection Attempt -- haberoku.asp id SELECT

sid 2005179 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php INSERT

sid 2005180 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPWind SQL Injection Attempt -- admin.php UPDATE

sid 2005181 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Tyger Bug Tracking System (TygerBT) SQL Injection Attempt -- ViewBugs.php s UNION SELECT

sid 2005185 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Online Web Building SQL Injection Attempt -- page.asp art_id SELECT

sid 2005186 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS W2B Online Banking SQL Injection Attempt -- DocPay.w2b listDocPay UNION SELECT

sid 2005187 format suricata T1190 ↗

Showing 1301-1350 of 48,683

Prev 27 Next

SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking

Detection Engineering
Detection coverage workspace
Saved stacks
SIEM query builder
Detection rules
D3FEND

Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Ransomware groups
Atomic tests

Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation

Compliance and GRC
Framework mapping
Control assessment
Audit view

Atlas Search Threat actors Techniques Detection coverage Tools & malware CWE CAPEC KEV catalog Package vulns

About All capabilities Pricing API docs Privacy policy Terms of service

threatengine.sh