Home/Detection rules/Suricata / ET-open
Tool
Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Using these IDS signatures
Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.
Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.
Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

Rules

50 shown of 48,683
sid 2005542 format suricata T1190 ↗
sid 2005544 format suricata T1190 ↗
sid 2005545 format suricata T1190 ↗
sid 2005546 format suricata T1190 ↗
sid 2005547 format suricata T1190 ↗
sid 2005548 format suricata T1190 ↗
sid 2005549 format suricata T1190 ↗
sid 2005550 format suricata T1190 ↗
sid 2005551 format suricata T1190 ↗
sid 2005552 format suricata T1190 ↗
sid 2005553 format suricata T1190 ↗
sid 2005554 format suricata T1190 ↗
sid 2005555 format suricata T1190 ↗
sid 2005556 format suricata T1190 ↗
sid 2005557 format suricata T1190 ↗
sid 2005558 format suricata T1190 ↗
sid 2005559 format suricata T1190 ↗
sid 2005560 format suricata T1190 ↗
sid 2005561 format suricata T1190 ↗
sid 2005562 format suricata T1190 ↗
sid 2005563 format suricata T1190 ↗
sid 2005564 format suricata T1190 ↗
sid 2005566 format suricata T1190 ↗
sid 2005570 format suricata T1190 ↗
Showing 1651-1700 of 48,683