Theory

Briefing: writing Suricata rules

Suricata is a high-performance, open-source IDS/IPS (Intrusion Detection and Prevention System). It inspects network traffic against a set of rules and raises an alert whenever traffic matches one. In this lab you write rules that catch specific malicious traffic inside captured packets.

Anatomy of a rule

A rule is a single line with two parts: a header, then a set of options in parentheses.

action protocol src_ip src_port -> dst_ip dst_port (options)

A concrete example that alerts on any TCP traffic heading to port 4444:

alert tcp any any -> any 4444 (msg:"Suspicious 4444"; sid:1000001; rev:1;)

action: what to do on a match. Here you always use alert.
protocol: tcp, udp, http, dns, tls, and so on.
src / dst ip and port: any matches everything, or use a literal like 10.10.0.123 and 80.
-> is the direction (source to destination). <> matches either way.
options live inside the parentheses, and each one ends with ;:
msg:"..."; the text shown with the alert. The checker looks at this, so match the wording the challenge asks for exactly.
sid:NNNN; a unique rule id (any number, for example 1000001).
rev:1; the rule revision.
matching keywords such as content:"...";, http.uri;, dns.query; and pcre:"/.../"; let you match on the payload or on protocol fields.

How these challenges are graded

Write your rule or rules into a file, for example nano myrules.rules.
Run the checker: /shared/suricata.sh myrules.rules.
Read its output carefully. When your rule fires correctly on the capture, the checker prints your flag.

Read the suricata.sh script itself to understand which capture it runs your rules against and what its output means. That tells you exactly what traffic you need to match.

Keep the official Suricata rule reference open: keywords like dns.query, http.uri, http.host, content and pcre each have a precise syntax.

Whoops Trafic

Goal: write a Suricata rule that detects TCP traffic destined for the host 10.10.0.123 and raises an alert with the exact message Whoops Detected.

Validate: write your rule into a file (for example nano myrules.rules), then run /shared/suricata.sh myrules.rules and read its output. If your rule fires correctly, your flag is printed.

💡 Hint: Check the official Suricata documentation for the rule header syntax, and read the suricata.sh output carefully. Reading the suricata.sh script itself also shows you which capture it runs your rules against.

Evil Serv

Goal: create a rule that alerts on DNS requests trying to resolve evil.serv. Use the message Evil Serv DNS.

Validate: write your rule into a file (for example nano myrules.rules), then run /shared/suricata.sh myrules.rules and read its output. If your rule fires correctly, your flag is printed.

💡 Hint: Use the dns protocol together with a DNS-specific matching option (look up dns.query). If you are sure your rule is correct but no flag appears, run the script a second time, just in case.

MicrosoftOnline

Goal: create a rule that alerts on HTTP traffic to http://microsoftonline.download/updates/KB4540673.msi. Use the message MicrosoftOnline HTTP.

Validate: write your rule into a file (for example nano myrules.rules), then run /shared/suricata.sh myrules.rules and read its output. If your rule fires correctly, your flag is printed.

💡 Hint: Use the tcp protocol on port 80, then narrow it down with content matching on the host name and the requested file path (look up the content keyword).

Exfil Alert

Goal: create an alert for HTTP requests carrying data exfiltrated by stage1_enc.py inside GIF files. Use the message Data Exfiltration Detected.

Validate: write your rule into a file (for example nano myrules.rules), then run /shared/suricata.sh myrules.rules and read its output. If your rule fires correctly, your flag is printed.

💡 Hint: Look at what stage1_enc.py produces, then match on the HTTP or TCP request content. The data is dressed up as a GIF, so the GIF file header makes a good anchor (look up the content keyword).

vlc_installer.exe Shell Alert

Goal: create an alert that detects a user downloading over HTTP a file whose payload is encoded like vlc_installer.exe's stagers (stage1, stage2, stage3) and that contains the Python call os.system specifically. Use the message Malicious Stager Detected.

Validate: write your rule into a file (for example nano myrules.rules), then run /shared/suricata.sh myrules.rules and read its output. If your rule fires correctly, your flag is printed.

💡 Hint: Use the tcp protocol on port 80. There is a tricky but smart way to do this: take a close look at how the stagers encode their payload in the file you have 😉.