Free_snort_suricata_rules_list.md

List of free Snort rules

Community rules

• https://www.snort.org/downloads/community/community-rules.tar.gz
  Beware, around 2600/3500 rules are not active by default.

Emerging threats rules

• https://rules.emergingthreats.net/open/suricata/rules/
  
• https://rules.emergingthreats.net/open/suricata/emerging.rules.tar.gz
  Updated daily.

VRT Rules

Free, you only need to be registered to get signatures of the commercial edition with a delay of 30 days.

• https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=YOUR_OINKCODE_HERE
  

SSL abuse rules

• https://sslbl.abuse.ch/blacklist/
  

SSL Fingerprint Blacklist

• https://sslbl.abuse.ch/blacklist/sslblacklist.rules
  Snort is not supporting SSL fingerprinting at the moment.

All IPs that SSLBL has seen in the past 30 days

• https://sslbl.abuse.ch/blacklist/sslipblacklist.rules
  

All IPs that SSLBL ever detected being associated with a malicious SSL certificate

• https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.rules
  

ZeuS Command & Control server

• https://zeustracker.abuse.ch/blocklist.php
  
• zeus.rules https://zeustracker.abuse.ch/blocklist.php?download=snort
  Already included in the emerging rules.