al0ne/suricata-rules resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1283 stars · 306 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A curated collection of high-quality Suricata IDS rules for detecting red-team tooling and malicious network behavior, including CobaltStrike, Metasploit, Empire, DNS/ICMP tunneling, webshells, cryptomining, and reverse shells. Each rule is organized by threat type with accompanying pcap samples for testing and validation.

Use cases

• detect cobalt strike beacon traffic with suricata
• ids rules for dns tunneling detection
• suricata signatures for webshell activity
• alert on reverse shell connections
• detect cryptomining traffic on the network
• find metasploit and empire c2 traffic
• network detection for red team tools

When to choose

• you run Suricata and want community-vetted signatures for common attacker tools
• you need pcap-backed rules you can test against real malicious traffic samples
• you want a single consolidated rules file covering C2, tunneling, webshells, and mining

When to avoid

• you use Snort rather than Suricata without adaptation
• you need continuously updated commercial-grade threat intel feeds
• you need host-based or endpoint detection rather than network signatures

Facets

dataset · maturity maintenance

security monitoring alerting security penetration-testing networking self-hosted ids suricata intrusion-detection network-signatures threat-detection red-team cobaltstrike dns-tunneling webshell reverse-shell linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="al0ne/suricata-rules")