# al0ne/suricata-rules

Suricata IDS rules 用来检测红队渗透/恶意行为等，支持检测CobaltStrike/MSF/Empire/DNS隧道/Weevely/菜刀/冰蝎/挖矿/反弹shell/ICMP隧道等

Repository: https://github.com/al0ne/suricata-rules
Canonical: https://ross.abutalabs.com/products/suricata-rules
License Family: other
Topics: suricata, suricata-rule, ids, signatures, security
Last push: 2023-07-08T08:10:42+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2911, "days_push": 1152, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1283, forks 306 (observed 2026-08-28T04:04:14.116565+00:00)

## What it is
A curated collection of high-quality Suricata IDS rules for detecting red-team tooling and malicious network behavior, including CobaltStrike, Metasploit, Empire, DNS/ICMP tunneling, webshells, cryptomining, and reverse shells. Each rule is organized by threat type with accompanying pcap samples for testing and validation.

## Use cases
- detect cobalt strike beacon traffic with suricata
- ids rules for dns tunneling detection
- suricata signatures for webshell activity
- alert on reverse shell connections
- detect cryptomining traffic on the network
- find metasploit and empire c2 traffic
- network detection for red team tools

## When to choose
- you run Suricata and want community-vetted signatures for common attacker tools
- you need pcap-backed rules you can test against real malicious traffic samples
- you want a single consolidated rules file covering C2, tunneling, webshells, and mining

## When to avoid
- you use Snort rather than Suricata without adaptation
- you need continuously updated commercial-grade threat intel feeds
- you need host-based or endpoint detection rather than network signatures

## Facets
- artifact type: dataset
- maturity: maintenance
- function: security, monitoring, alerting
- domain: security, penetration-testing, networking
- platform: self-hosted
- tags: ids, suricata, intrusion-detection, network-signatures, threat-detection, red-team, cobaltstrike, dns-tunneling, webshell, reverse-shell, linux, web-server

## Member repositories
- al0ne/suricata-rules (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:14.116565+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:56:47.826109+00:00, confidence not recorded.
  - readme: https://github.com/al0ne/suricata-rules (fetched 2026-08-28T04:04:14.116565+00:00, sha 7e955c1eb390)
- Data as of 2026-08-30T08:39:29.467469+00:00.