# VEDAS-Driven Autonomous Generation + Community Contributions of Suricata & Nuclei Rules for CVEs

[![Suricata](https://github.com/ARPSyndicate/vedas-signatures/actions/workflows/suricata.yml/badge.svg)](https://github.com/ARPSyndicate/vedas-signatures/actions/workflows/suricata.yml)
[![Nuclei](https://github.com/ARPSyndicate/vedas-signatures/actions/workflows/nuclei.yml/badge.svg)](https://github.com/ARPSyndicate/vedas-signatures/actions/workflows/nuclei.yml)

This repository is an open, collaborative validation space for CVE detection content:

- **Suricata rules**: network detection of exploitation attempts.
- **Nuclei templates**: active, non-destructive checks for exposure to a CVE.

Most signatures are generated autonomously by **ARPSyndicate's Vulnerability & Exploit Data Aggregation System ([VEDAS](https://kenzer.arpsyndicate.io/vedas))**. AI lets us create detection content quickly and at scale from vulnerability and exploit intelligence. Reliable detection still needs **transparency, human review and real-world testing**, so the content is published here for the community to **review, validate, fix and extend** through issues and pull requests.

## Coverage

<!-- STATS:START -->
**13,891 unique CVEs covered.** Most carry both a Suricata rule and a Nuclei template; 173 destructive or DoS CVEs are network-detection-only — a passive Suricata rule with no active Nuclei check (listed in [SURICATA_ONLY.txt](SURICATA_ONLY.txt)).

| CVE year | Suricata Signatures | Nuclei Signatures |
| --- | ---: | ---: |
| 1999 | 6 | 6 |
| 2000 | 19 | 19 |
| 2001 | 23 | 21 |
| 2002 | 73 | 73 |
| 2003 | 69 | 69 |
| 2004 | 187 | 186 |
| 2005 | 538 | 537 |
| 2006 | 1,418 | 1,416 |
| 2007 | 1,132 | 1,129 |
| 2008 | 1,753 | 1,745 |
| 2009 | 803 | 799 |
| 2010 | 677 | 675 |
| 2011 | 181 | 179 |
| 2012 | 311 | 306 |
| 2013 | 220 | 215 |
| 2014 | 326 | 320 |
| 2015 | 227 | 225 |
| 2016 | 156 | 151 |
| 2017 | 384 | 369 |
| 2018 | 562 | 535 |
| 2019 | 403 | 386 |
| 2020 | 508 | 501 |
| 2021 | 730 | 713 |
| 2022 | 697 | 691 |
| 2023 | 713 | 710 |
| 2024 | 783 | 776 |
| 2025 | 524 | 517 |
| 2026 | 469 | 449 |
<!-- STATS:END -->

## Layout

```
suricata/<YYYY>/CVE-YYYY-NNNNN.rules   # one file per CVE, one rule per line
nuclei/<YYYY>/CVE-YYYY-NNNNN.yaml      # one template per CVE
payloads/                              # self-hosted PoC payloads (SVG/DTD/CSV/…) so checks need no external host
scripts/                               # validation tooling used by CI (run it locally too)
.github/                               # CI workflows, issue forms, PR template
```

`<YYYY>` is the CVE year, not the year the signature was written.

## Using the signatures

**Suricata** (tested on Suricata 8.x):

```bash
cat suricata/*/*.rules > vedas.rules
suricata -T -c /etc/suricata/suricata.yaml -S vedas.rules   # test-load first
```

Or add the directory to `rule-files:` in `suricata.yaml`. SIDs `1000000-1999999` come from VEDAS and `3000000-3999999` from the community. Neither range overlaps ET Open.

**Nuclei** (tested on Nuclei v3):

```bash
nuclei -t nuclei/ -u https://target.example
```

Only scan systems you are authorised to test.

## Contributing

Contributions of every kind are welcome:

| You want to... | Do this |
| --- | --- |
| Report a rule that fires on benign traffic | [False positive issue](../../issues/new?template=false-positive.yml) |
| Report a rule that misses real exploitation | [False negative issue](../../issues/new?template=false-negative.yml) |
| Report a rule that fails to load or is slow | [Broken signature issue](../../issues/new?template=broken-signature.yml) |
| Ask for coverage of a CVE | [Signature request](../../issues/new?template=signature-request.yml) |
| Fix or add a signature | Open a pull request: see **[CONTRIBUTING.md](CONTRIBUTING.md)** |

Every pull request is checked automatically. It must load in real Suricata/Nuclei engines and pass the repository lint, and the target CVE must exist on cve.org. You can run the same checks locally before pushing (see [CONTRIBUTING.md](CONTRIBUTING.md#validate-locally)).

## Disclaimer

Signatures generated by VEDAS are **syntactically validated only**. Logical testing has not been performed in most cases. **Validate every signature in your own environment before deploying it.** Community-reviewed signatures are marked as such in their pull request history. This content is provided as-is, without warranty of any kind (see [LICENSE](LICENSE)).

Signatures are **self-contained and on-prem friendly**: every PoC payload a check needs is stored in [`payloads/`](payloads/) and served from this repository, with no dependency on any third-party host.

## Acknowledgements

VEDAS aggregates openly available intelligence (OSINT) from across the internet — vulnerability databases, advisories, exploit and PoC publications, detection rulesets, and research shared by vendors, CERTs, independent researchers, and the wider cybersecurity community. This feed is built on that collective knowledge, and we're grateful to everyone who contributes to it. Where specific detection logic was adapted from an openly licensed project — notably [projectdiscovery/nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) (MIT) — it is credited in [NOTICE](NOTICE). Community contributors are credited in each template's `info.author` and in the pull-request history.

Please report security issues in this repository's tooling privately. See [SECURITY.md](SECURITY.md).