Home/Network IDS rules
IDS / IPS

Network IDS rules

52,690 rules · Snort / Suricata signatures
Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.
Ruleset All et-opensnort-community
Class All trojan-activitydomain-c2bad-unknownweb-application-attackmisc-activitycommand-and-controlattempted-adminexploit-kitsocial-engineeringcredential-theftattempted-usertargeted-activityattempted-reconpup-activity
◈

Rules

50 shown of 52,690
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- forums.php post_id UPDATE
sid 2004217 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id SELECT
sid 2004218 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id UNION SELECT
sid 2004219 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id INSERT
sid 2004220 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id DELETE
sid 2004221 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id ASCII
sid 2004222 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS phpx SQL Injection Attempt -- users.php user_id UPDATE
sid 2004223 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp SELECT
sid 2004224 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp UNION SELECT
sid 2004225 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp INSERT
sid 2004226 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp DELETE
sid 2004227 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp ASCII
sid 2004228 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- functions_filters.asp UPDATE
sid 2004229 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name SELECT
sid 2004230 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name UNION SELECT
sid 2004231 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name INSERT
sid 2004232 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name DELETE
sid 2004233 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- pop_up_member_search.asp name UPDATE
sid 2004234 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID SELECT
sid 2004235 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID UNION SELECT
sid 2004236 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID INSERT
sid 2004237 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID DELETE
sid 2004238 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID ASCII
sid 2004239 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Web Wiz Forums SQL Injection Attempt -- page.asp NewsID UPDATE
sid 2004240 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip SELECT
sid 2004241 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip UNION SELECT
sid 2004242 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip INSERT
sid 2004243 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip DELETE
sid 2004244 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip ASCII
sid 2004245 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS PHP-Stats SQL Injection Attempt -- php-stats.recphp.php ip UPDATE
sid 2004246 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php SELECT
sid 2004247 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php UNION SELECT
sid 2004248 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php INSERT
sid 2004249 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php DELETE
sid 2004250 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php ASCII
sid 2004251 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Woltlab Burning Board SQL Injection Attempt -- usergroups.php UPDATE
sid 2004252 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id SELECT
sid 2004253 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UNION SELECT
sid 2004254 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id INSERT
sid 2004255 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id DELETE
sid 2004256 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id ASCII
sid 2004257 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS WSN Guest SQL Injection Attempt -- comments.php id UPDATE
sid 2004258 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid SELECT
sid 2004259 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid UNION SELECT
sid 2004260 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid INSERT
sid 2004261 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid DELETE
sid 2004262 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid ASCII
sid 2004263 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Particle Blogger SQL Injection Attempt -- post.php postid UPDATE
sid 2004264 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x SELECT
sid 2004265 format suricata T1190 ↗
et-open web-application-attack
ET WEB_SPECIFIC_APPS Koan Software Mega Mall SQL Injection Attempt -- product_review.php x UNION SELECT
sid 2004266 format suricata T1190 ↗
Showing 551-600 of 52,690
Prev 12 Next
SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking
Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND
Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Ransomware groups
Atomic tests
Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation
Compliance and GRC
Framework mapping
Control assessment
Audit view
Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns
About All capabilities Pricing API docs Privacy policy Terms of service
threatengine.sh