The idea behind this project is to categorize and develop, where feasible, Suricata (and general NSM) rules by mapping them against the MITRE ATT&CK framework.

Each technique has its own folder. Inside the folder, one of two things can happen:

• We will link to existing rules from known rulesets if a rule already exists
• We will share the rule in the format used by Suricata

The following rulesets are currently considered by this project:

• Emerging Threats Open
• Emerging Threats Pro

Feel free to reach out to me via Twitter (@0xtf) if you have some rules you'd like to share or comments/questions/tips.

Browse supported techniques using this URL.

If you're interested in working in this project, 3CORESec has a sponsorship program that allows you to get paid for your contributions to open source projects.

Get in touch for more information!