https://github.com/sudohyak/suricata-rules

Suricata rules for the new critical vulnerabilities
https://github.com/sudohyak/suricata-rules

suricata-rules

Last synced: about 6 hours ago
JSON representation

Suricata rules for the new critical vulnerabilities

• Host: GitHub
• URL: https://github.com/sudohyak/suricata-rules
• Owner: sudohyak
• License: gpl-3.0
• Created: 2020-11-10T15:36:31.000Z (about 4 years ago)
• Default Branch: main
• Last Pushed: 2021-01-26T15:50:14.000Z (almost 4 years ago)
• Last Synced: 2023-02-23T10:26:20.859Z (over 1 year ago)
• Topics: suricata-rules
• Homepage:
• Size: 44.9 KB
• Stars: 63
• Watchers: 4
• Forks: 23
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-technostructure - sudohyak/suricata-rules - rules: Suricata rules for the new critical vulnerabil ([🔓 security](https://github.com/stars/ketsapiwiq/lists/unlock-security))
• awesome-technostructure - sudohyak/suricata-rules - rules: Suricata rules for the new critical vulnerabil ([🔓 security](https://github.com/stars/ketsapiwiq/lists/unlock-security))

README

        
## What is Suricata?

Suricata is a free and open source, mature, fast and robust network threat detection engine.  

For more information, go to https://suricata-ids.org/.

## The purpose of this repository

* Supporting blue team members writing Suricata rules for the new critical vulnerabilities to detect and prevent the exploitation of attackers as soon as possible.

* Updating Suricata rules regularly and holding them in a well-managed database.

## The content structure

Each vulnerability owns a folder.  

Each folder has 2 main parts:

* The file README.md includes 3 parts:

  * Overview of the vulnerability

  * Proof of Concept (PoC) or in other words, the samples of the malicious payloads

  * References

* The file .rules holds the Suricata rule itself.

## Notes

* Many services run on HTTPS but Suricata cannot analyze encrypted data. If you want to use Suricata to detect attackers in your HTTPS payload, you should set up a reverse proxy for HTTPS like nginx, then forward HTTP to your application servers, and run Suricata on this HTTP traffic.

* Instead of **any any -> any any**, you can set your own networks and ports configuration if you are sure about your system usage. For example, you have an HTTP server runs only on port 8443 and receives traffic from $HOME_NET, it will be **any any -> $HOME_NET 8443**.

* You should change the **sid** to match your own configuration. In this repository, I often use a nearly random value for this field.

## Want to support its development?

Buy me a coffee via Paypal: https://paypal.me/sudoka