Active ruleset sources
A concise list of active Suricata rulesets, their publishers, summaries, home pages, and subscription links where access is required.
25 active rulesets indexed
The Suricata Botnet C2 IP Ruleset contains botnet C2s tracked by Feodo Tracker and can be used for both, Suricata and Snort open source IDS/IPS. If you are running Suricata or Snort, you can use this ruleset to detect and/or block network connections towards hostline servers (IP address:port combination).
The SSL Blacklist (SSLBL) is a project of abuse.ch with the goal of detecting malicious SSL connections, by identifying and blacklisting SSL certificates used by botnet C&C servers. In addition, SSLBL identifies JA3 fingerprints that helps you to detect & block malware botnet C&C communication on the TCP layer.
If you are running Suricata, you can use the SSLBL's Suricata JA3 fingerprint ruleset to detect and/or block malicious SSL connections in your network based on the JA3 fingerprint. Please note that your need Suricata 4.1.0 or newer in order to use the JA3 fingerprint ruleset.
URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution.
This ruleset is built using malicious URLs and domains involved in phishing attacks, utilizing community APIs like Phishstats and Openphish. Hourly updates with cumulative SID
Proofpoint ET Open is a timely and accurate rule set for detecting and blocking advanced threats
et/pro
Subscription required
Proofpoint ET Pro is a timely and accurate rule set for detecting and blocking advanced threats
IPFire DBL is a comprehensive, community-maintained domain blocklist that protects your network from malware, phishing, unwanted content, and emerging threats
Suricata ruleset specifically focused on detecting lateral movement in Microsoft Windows environments by Stamus Networks
stamus/nrd-14-open
Subscription required
Newly Registered Domains list (last 14 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
stamus/nrd-entropy-14-open
Subscription required
Suspicious Newly Registered Domains list with high entropy (last 14 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
stamus/nrd-phishing-14-open
Subscription required
Suspicious Newly Registered Domains Phishing list (last 14 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
stamus/nrd-30-open
Subscription required
Newly Registered Domains list (last 30 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
stamus/nrd-entropy-30-open
Subscription required
Suspicious Newly Registered Domains list with high entropy (last 30 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
stamus/nrd-phishing-30-open
Subscription required
Suspicious Newly Registered Domains Phishing list (last 30 days) to match on DNS, TLS and HTTP communication. Produced by Stamus Labs research team.
PAW Patrules ruleset permit to detect many events on network. Suspicious flow, malicious tool, unsuported and vulnerable system, known threat actors with various IOCs, lateral movement, bad practice, shadow IT... Rules are frequently updated.
PT Rules, an open-source project focused on enhancing network security through proactive threat detection. As the PT Expert Security Center attack detection team, we are a dedicated group of cybersecurity experts committed to improve network security through open-source initiatives.
scwx/enhanced
Subscription required
Broad ruleset composed of malware rules and other security-related countermeasures, and curated by the Secureworks Counter Threat Unit research team. This ruleset has been enhanced with comprehensive and fully standard-compliant BETTER metadata (https://better-schema.readthedocs.io/).
scwx/malware
Subscription required
High-fidelity, high-priority ruleset composed mainly of malware-related countermeasures and curated by the Secureworks Counter Threat Unit research team.
scwx/security
Subscription required
Broad ruleset composed of malware rules and other security-related countermeasures, and curated by the Secureworks Counter Threat Unit research team.
These detection rules work by looking for specific NMAP packet window sizes, flags, port numbers, and known NMAP timing intervals.
Community Suricata ruleset derived from original malware and open-directory investigations published at the-hunters-ledger.com. Updated as new campaigns are analyzed.
Heuristic ruleset for hunting. Focus on anomaly detection and showcasing latest engine features, not performance.