Network IDS rules · threatengine.sh

Home/Network IDS rules

IDS / IPS

Network IDS rules

52,690 rules · Snort / Suricata signatures

Network intrusion-detection signatures from open rulesets (ET Open, Snort Community, abuse.ch). These match malicious traffic patterns on the wire. A rule name links to its upstream reference where the ruleset publishes one; rules without a public reference show as plain text.

◈

Rules

50 shown of 52,690

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id SELECT

sid 2004041 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id UNION SELECT

sid 2004042 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id INSERT

sid 2004043 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id DELETE

sid 2004044 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id ASCII

sid 2004045 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS PHPEcho CMS SQL Injection Attempt -- gallery.php id UPDATE

sid 2004046 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen SELECT

sid 2004047 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen UNION SELECT

sid 2004048 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen INSERT

sid 2004049 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen DELETE

sid 2004050 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen ASCII

sid 2004051 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- courseLog.php scormcontopen UPDATE

sid 2004052 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category SELECT

sid 2004053 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category UNION SELECT

sid 2004054 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category INSERT

sid 2004055 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category DELETE

sid 2004056 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category ASCII

sid 2004057 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- category.php id_category UPDATE

sid 2004058 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating SELECT

sid 2004059 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating UNION SELECT

sid 2004060 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating INSERT

sid 2004061 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating DELETE

sid 2004062 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating ASCII

sid 2004063 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php rating UPDATE

sid 2004064 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course SELECT

sid 2004065 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course UNION SELECT

sid 2004066 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course INSERT

sid 2004067 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course DELETE

sid 2004068 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course ASCII

sid 2004069 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course UPDATE

sid 2004070 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id SELECT

sid 2004071 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id UNION SELECT

sid 2004072 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id INSERT

sid 2004073 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id DELETE

sid 2004074 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id ASCII

sid 2004075 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS 2z Project SQL Injection Attempt -- rating.php post_id UPDATE

sid 2004076 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php SELECT

sid 2004077 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php UNION SELECT

sid 2004078 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php INSERT

sid 2004079 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php DELETE

sid 2004080 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php ASCII

sid 2004081 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS Jelsoft vBulletin SQL Injection Attempt -- attachment.php UPDATE

sid 2004082 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid SELECT

sid 2004083 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid UNION SELECT

sid 2004084 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid INSERT

sid 2004085 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid DELETE

sid 2004086 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid ASCII

sid 2004087 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS DGNews SQL Injection Attempt -- news.php catid UPDATE

sid 2004088 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id SELECT

sid 2004095 format suricata T1190 ↗

et-open web-application-attack

ET WEB_SPECIFIC_APPS My Little Forum SQL Injection Attempt -- user.php id UNION SELECT

sid 2004096 format suricata T1190 ↗

Showing 401-450 of 52,690

Prev 9 Next

SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking

Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND

Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Atomic tests

Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation

Compliance and GRC
Framework mapping
Control assessment
Audit view

Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns

About All capabilities Pricing API docs Privacy policy Terms of service

threatengine.sh