KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #codex #typescript #ai-agents #ai-agent #cli #claude-code #open-source #deepseek-harness #dsh-plugin #python #mcp

snort-rule-generator

★ 18 Open GitHub ↗

Quickly generate snort rules for IOCs

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

snort-rule-generator
====================

This script can quickly generate Snort rules for common network behaviors from IOCs. Best effort is made to make the rules efficient.

######Usage:

```
./snort_rule_generator.pl -h

Valid Options:
--type => required parameter, specify type of signature you want to generate.
        dns-query | dns query for a domain
        dns-reply | match a dns reply containing a specified IP/CIDR
        http-req-domain | http request for a specific domain
        http-file-name | http request for a specific file name
--value => required parameter, contains the key value you want to generate the signature for.
--help => print usage information
```

######DNS queries:

```
./snort_rule_generator.pl --type dns-query --value google.com
alert udp $HOME_NET any -> any 53 (msg:""; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|google|03|com|00|"; fast_pattern; nocase; distance:0; classtype:trojan-activity; sid:xxxx; rev:1;)
```

######DNS replies:

```
#ip address
 ./snort_rule_generator.pl --type dns-reply --value 12.3.4.56
alert udp any 53 -> $HOME_NET any (msg:"DNS Reply - IP - 12.3.4.56"; content:"|00 01 00 01|"; content:"|00 04 0C 03 04 38|"; distance:4; within:6; classtype:trojan-activity; sid:xxxx; rev:1;)

#class c cidr
./snort_rule_generator.pl --type dns-reply --value 1.2.3
alert udp any 53 -> $HOME_NET any (msg:"DNS Reply - IP - 1.2.3."; content:"|00 01 00 01|"; content:"|00 04 01 02 03|"; distance:4; within:5; classtype:trojan-activity; sid:xxxx; rev:1;)
```

######HTTP domains:

```
./snort_rule_generator.pl --type http-req-domain --value google.com
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"HTTP Request to domain - google.com"; flow:established,to_server; content:"Host|3a 20|google.com|0d 0a|"; http_header; fast_pattern:only; classtype:trojan-activity; sid:xxxx; rev:1;)
```

######HTTP requests containing a file name:

```
./snort_rule_generator.pl --type http-file-name --value malware.exe
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"HTTP Request with filename - malware.exe"; flow:established,to_server; content:"malware.exe"; http_uri; fast_pattern:only; pcre:"/malware\.exe$/U"; classtype:trojan-activity; sid:xxxx; rev:1;)
```

snort-rule-generator

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README