< Back to projects

Suricata IDS/IPS: Custom Detection Rules

Bachelor 3 - ESGI Solo December 2024 Completed

Hands-on deployment and configuration of a Suricata IDS/IPS, from setting up the capture environment to writing and validating custom detection rules against real malicious traffic.

Suricata detection pipeline Network traffic / eternalblue pcap af-packet inline capture Suricata rule engine (final_local.rules) Scan / recon SSH brute force SQL injection / XSS Shellcode
Traffic captured inline (af-packet) is matched against the custom rule set, which classifies alerts by attack category.

Context

A solo lab turning theoretical coursework into a working deployment: installing Suricata, configuring suricata.yaml to run in IDS, IPS, or IDPS mode via af-packet capture, then writing tailored detection rules.

What was built

  • Suricata configured in af-packet mode for inline capture, switchable between IDS (passive detection) and IPS (active blocking).
  • A custom rule set (final_local.rules) covering: ICMP ping detection, shellcode, access to sensitive paths (/admin, /wp-admin), SSH brute force, SQL injection, XSS, and Nmap-style scans.
  • Rules validated by replaying a real pcap containing EternalBlue exploitation traffic, confirming the expected alerts fired.
  • Additional hardening of remote access to the capture host (secured SSH) so the monitoring box itself would not be the weak link.

Stack

Suricata af-packet Snort-style rules Pcap analysis SSH hardening

Status

Lab completed and validated, rules tested against real traffic.

< All projects