Network IDS rules · threatengine.sh

Home/Network IDS rules

IDS / IPS

Network IDS rules

6,264 rules · Snort / Suricata signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

◈

Rules

50 shown of 6,264

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPNuke SQL injection attempt

sid 2001197 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPNuke general SQL injection attempt

sid 2001202 format suricata T1190 ↗

et-open web-application-attack

ET ACTIVEX winhlp32 ActiveX control attack - phase 1

sid 2001622 format suricata

et-open web-application-attack

ET ACTIVEX winhlp32 ActiveX control attack - phase 2

sid 2001623 format suricata

et-open web-application-attack

ET ACTIVEX winhlp32 ActiveX control attack - phase 3

sid 2001624 format suricata

et-open web-application-attack

ET WEB_SPECIFIC_APPS e107 resetcore.php SQL Injection attempt

sid 2002663 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Galerie ShowGallery.php SQL Injection attempt

sid 2002671 format suricata T1190 ↗

et-open web-application-attack

ET SCAN Nikto Web App Scan in Progress

sid 2002677 format suricata

et-open web-application-attack

ET WEB_SPECIFIC_APPS Cyphor show.php SQL injection attempt

sid 2002678 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHP phpMyAgenda rootagenda Remote File Include Attempt

sid 2002879 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHP Aardvark Topsites PHP CONFIG PATH Remote File Include Attempt

sid 2002901 format suricata T1190 ↗

et-open web-application-attack

ET SCAN PHP Attack Tool Morfeus F Scanner

sid 2003466 format suricata

et-open web-application-attack

ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id UNION SELECT

sid 2004000 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id INSERT

sid 2004001 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id DELETE

sid 2004002 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id ASCII

sid 2004003 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Gazi Download Portal SQL Injection Attempt -- down_indir.asp id UPDATE

sid 2004004 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id SELECT

sid 2004005 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id UNION SELECT

sid 2004006 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id INSERT

sid 2004007 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id DELETE

sid 2004008 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id ASCII

sid 2004009 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS ol bookmarks SQL Injection Attempt -- index.php id UPDATE

sid 2004010 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie SELECT

sid 2004011 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie UNION SELECT

sid 2004012 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie INSERT

sid 2004013 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie DELETE

sid 2004014 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie ASCII

sid 2004015 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS WordPress SQL Injection Attempt -- admin-ajax.php cookie UPDATE

sid 2004016 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style SELECT

sid 2004023 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style UNION SELECT

sid 2004024 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style INSERT

sid 2004025 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style DELETE

sid 2004026 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style ASCII

sid 2004027 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php style UPDATE

sid 2004028 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue SELECT

sid 2004029 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue UNION SELECT

sid 2004030 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue INSERT

sid 2004031 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue DELETE

sid 2004032 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue ASCII

sid 2004033 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS BtiTracker SQL Injection Attempt -- account_change.php langue UPDATE

sid 2004034 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php SELECT

sid 2004035 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php UNION SELECT

sid 2004036 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php INSERT

sid 2004037 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php DELETE

sid 2004038 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php ASCII

sid 2004039 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS CubeCart SQL Injection Attempt -- cart.inc.php UPDATE

sid 2004040 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id SELECT

sid 2004041 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id UNION SELECT

sid 2004042 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id INSERT

sid 2004043 format suricata T1190 ↗

Showing 1-50 of 6,264

Prev 1 Next

SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking

Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND

Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Atomic tests

Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation

Compliance and GRC
Framework mapping
Control assessment
Audit view

Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns

About All capabilities Pricing API docs Privacy policy Terms of service

threatengine.sh