IDS - Rule Categories - Emerging Threat Categories

NOTE: Some signatures are not inherently malicious but may be of interest to organizations or for logging purposes.

Protects against attacks and exploits of:

Category	Description	Reference
3CORESec	Generated automatically from the 3CORESec team IP block lists; based on malicious activity from their Honeypots.	https://blacklist.3coresec.net/lists/et-open.txt
ActiveX	Attacks and vulnerabilities regarding Microsoft ActiveX controls.
Adware-PUP	Ad-tracking and spyware related activity.
Attack Response	Identifies responses indicative of intrusion; such as LMHost file download, presence of certain web banners and the detection of Metasploit Meterpreter kill command.
Attack Response	These are designed to catch the results of a successful attack. Things like “id=root”, or error messages that indicate a compromise may have happened.
Botcc (Bot Command and Control)	Auto-generated from several sources of known and confirmed active botnet and other Command and Control (C2) hosts.	https://www.shadowserver.org
Botcc Portgrouped	Similar to the Botcc category but grouped by destination port. Rules grouped by port can offer higher fidelity than those not grouped by port.
Chat	Chat clients such as Internet Relay Chat (IRC).
CIArmy	Generated using Collective Intelligence IP blocking rules.	https://www.cinsscore.com
Coinmining	Malware which performs coin mining.
Compromised	Known compromised hosts; updated daily from several private but highly reliable data sources.
Compromised	WARNING: This category can add significant processing load. In a high-capacity situation it is recommended to use the Botcc rules instead.
Current Events	Active and short-lived campaigns and high-profile items that are expected to be temporary; such as fraud campaigns related to disasters.
Current Events	The rules in this category are not intended to be kept in the ruleset for long.
Deleted	Signatures removed from a rule set; often due to being problematic or duplicates or being super-seeded.
DNS	Attacks and vulnerabilities regarding Domain Name Service (DNS) including tunneling.
DOS	Denial of Service (DoS) attempts.
Drop	To block IP addresses on the Spamhaus DROP (Do not Route or Peer) list, which is updated daily.	https://www.spamhaus.org
Dshield	Attackers identified by Dshield, updated daily from the DShield top attackers list which is very reliable.	https://www.dshield.org
Exploit	Direct exploits not otherwise covered in a specific service category; including vulnerabilities against Microsoft Windows.
Exploit	Attacks with their own category such as SQL injection have their own category.
Exploit-Kit	Activity related to Exploit Kits.
FTP	Attacks, exploits, and vulnerabilities regarding File Transfer Protocol (FTP).
FTP	Also includes basic none malicious FTP activity for logging purposes, such as login, etc.
Games	Gaming traffic.
Games	Not necessarily evil, just not appropriate for all environments.
Hunting	Threat hunting in an environment.
Hunting	WARNING: These rules can provide false positives on legitimate traffic and inhibit performance. They are only recommended for use when actively researching potential threats in the environment.
ICMP	Internet Control Message Protocol (ICMP).
ICMP_info	ICMP protocol specific events, typically associated with normal operations for logging purposes.
IMAP	Internet Message Access Protocol (IMAP).
Inappropriate	Sites that are pornographic or otherwise not appropriate for a work environment.
Inappropriate	WARNING: This category can have a significant performance impact and high rate of false positives.
Info	Helps provide audit level events that are useful for correlation and identifying interesting activity which may not be inherently malicious but is often observed in malware and other threats
Info	Example: Downloading an Executable over HTTP by IP address rather than domain name.
JA3	Fingerprints malicious SSL certificates using JA3 hashes.
JA3	WARNING: These rules can have a high false positive rate but can be very useful for threat hunting or malware detonation.
Malware	Malicious software and Spyware related.
Misc	Not covered in other categories.
Mobile Malware	Malware associated with mobile and tablet operating systems.
Mobile Malware	Malware associated with mobile operating systems will generally be placed in this category rather than the standard categories like Malware.
NETBIOS	Attacks, exploits and vulnerabilities regarding Netbios.
NETBIOS	Also included are rules detecting basic activity of the protocol for logging purposes.
P2P	Peer-to-Peer (P2P), including torrents, edonkey, Bittorrent, Gnutella and Limewire among others.
P2P	Not necessarily evil, just not appropriate for all environments.
Phishing	Phishing activity.
Policy	May indicate violations against policies of an organization.
Policy	Includes DropBox, Google Apps, Myspace, Ebay, etc. Also covers off port protocols, basic DLP such as credit card numbers and social security numbers.
POP3	Post Office Protocol 3.0 (POP3).
RPC	Remote Procedure Call (RPC).
SCADA	Supervisory control and data acquisition (SCADA).
SCADA_special	Signatures written for Snort Digital Bond based SCADA preprocessor.
SCAN	Reconnaissance and probing from tools such as Nessus, Nikto, and other port scanning tools.
Shellcode	Remote shellcode detection.
SMTP	Attacks, exploits, and vulnerabilities regarding Simple Mail Transfer Protocol (SMTP).
SMTP	Also includes rules detecting basic activity of the protocol for logging purposes.
SNMP	attacks, exploits, and vulnerabilities regarding Simple Network Management Protocol (SNMP).
SNMP	Also includes rules detecting basic activity of the protocol for logging purposes.
SQL	attacks, exploits, and vulnerabilities regarding Structured Query Language (SQL).
SQL	Also includes rules detecting basic activity of the protocol for logging purposes.
TELNET	attacks and vulnerabilities regarding the TELNET service.
TELNET	Also includes rules detecting basic activity of the protocol for logging purposes.
TFTP	attacks and vulnerabilities regarding the Trivial File Transport Protocol (TFTP).
TFTP	Also includes rules detecting basic activity of the protocol for logging purposes.
TOR	Identification of traffic to and from TOR exit nodes based on IP address.
Trojan	A legacy category not used in new versions of Suricata. Super-seeded by the Malware category.
User Agents	Suspicious and anomalous user agents.
User Agents	Known malicious user agents are generally placed in the Malware category.
VOIP	Attacks and vulnerabilities regarding Voice over IP (VOIP) including SIP, H.323 and RTP among others.
Web Client	Web clients such as web browsers as well as client side applications like CURL, WGET and others.
Web Server	Web server infrastructure such as APACHE, TOMCAT, NGINX, Microsoft Internet Information Services (IIS) and other web server software.
Web Specific Apps	Attacks and vulnerabilities in specific web applications.
WORM	Worm-like propagation.

References

https://tools.emergingthreats.net/docs/ETPro%20Rule%20Categories.pdf