Suricata / ET-open rules · threatengine.sh

Home/Detection rules/Suricata / ET-open

Tool

Network IDS

Suricata / ET-open

48,683 rules · network intrusion-detection signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

Using these IDS signatures

Deploy. Load them into a Suricata or Snort sensor and reload the ruleset; the sensor inspects traffic inline or from a tap or SPAN port and alerts (or drops) the moment a packet matches.

Adapt. Set the action per rule (alert vs drop), make sure the sensor actually sees the traffic in question - TLS payloads need decryption first - and silence noisy signatures that do not fit your network.

Scope. These catch malicious patterns on the wire: C2 beacons, exploit attempts, known-bad hosts. Pair them with endpoint and log detection, since encrypted or host-local activity never crosses the sensor.

◈

Rules

50 shown of 48,683

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin ASCII

sid 2005740 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchkey.asp searchin UPDATE

sid 2005741 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 SELECT

sid 2005742 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 UNION SELECT

sid 2005743 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 INSERT

sid 2005744 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 DELETE

sid 2005745 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 ASCII

sid 2005746 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost1 UPDATE

sid 2005747 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 SELECT

sid 2005748 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 UNION SELECT

sid 2005749 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 INSERT

sid 2005750 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 DELETE

sid 2005751 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 ASCII

sid 2005752 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp cost2 UPDATE

sid 2005753 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 SELECT

sid 2005754 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 UNION SELECT

sid 2005755 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 INSERT

sid 2005756 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 DELETE

sid 2005757 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 ASCII

sid 2005758 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp acreage1 UPDATE

sid 2005759 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 SELECT

sid 2005760 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 UNION SELECT

sid 2005761 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 INSERT

sid 2005762 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 DELETE

sid 2005763 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 ASCII

sid 2005764 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Rialto SQL Injection Attempt -- searchoption.asp squarefeet1 UPDATE

sid 2005765 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk SELECT

sid 2005766 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk UNION SELECT

sid 2005767 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk INSERT

sid 2005768 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk DELETE

sid 2005769 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk ASCII

sid 2005770 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS bitweaver SQL Injection Attempt -- edition.php tk UPDATE

sid 2005771 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName SELECT

sid 2005778 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName UNION SELECT

sid 2005779 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName INSERT

sid 2005780 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName DELETE

sid 2005781 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName ASCII

sid 2005782 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Motionborg Web Real Estate SQL Injection Attempt -- admin_check_user.asp txtUserName UPDATE

sid 2005783 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid SELECT

sid 2005784 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid UNION SELECT

sid 2005785 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid INSERT

sid 2005786 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid DELETE

sid 2005787 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid ASCII

sid 2005788 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPKIT SQL Injection Attempt -- comment.php subid UPDATE

sid 2005789 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID SELECT

sid 2005790 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID UNION SELECT

sid 2005791 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID INSERT

sid 2005792 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID DELETE

sid 2005793 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID ASCII

sid 2005794 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ShopStoreNow E-commerce Shopping Cart SQL Injection Attempt -- orange.asp CatID UPDATE

sid 2005795 format suricata T1190 ↗

Showing 1851-1900 of 48,683

Prev 38 Next

◈SOC and Response

◆Detection Engineering

◎Threat Hunting

▲Red Team and Pentest

■Compliance and GRC

◯About

threatengine.sh