I85PREP
⌘ K
OffSec Threat Hunter study materials
OffSec Threat Hunter study resources

OffSec Threat Hunter: IDS and IPS with Suricata: Rules, Modes and Reasoning

OffSec Threat Hunter · Work through your exam, one topic at a time.

All guide sections

IDS and IPS with Suricata: Rules, Modes and Reasoning

Suricata is the signature engine most often examined for IDS and IPS work. This domain tests rule syntax, deployment mode and whether you can read a rule and predict what it will and will not catch.

Rule anatomy

A rule has an action (alert, pass, drop, reject), a protocol, source and destination with direction (-> or <>), and options in parentheses. Required options are msg, sid and rev; classtype, reference, metadata, flow, content, pcre and the sticky buffers (http.uri, http.user_agent, dns.query, tls.sni) do the real work. threshold and detection_filter suppress floods. Suricata is multi-threaded, parses protocols, extracts files, logs EVE JSON, and computes JA3 and JA3S.

IDS versus IPS

In IDS mode Suricata only alerts, even if a rule says drop. Inline deployment requires af-packet in IPS copy mode, or netmap, plus correct interface and routing so traffic actually passes through the sensor.

Worked example

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious PowerShell user agent"; flow:established,to_server; http.user_agent; content:"WindowsPowerShell"; nocase; sid:1000001; rev:1;) Reasoning: flow:established,to_server limits matching to client requests on established sessions; the http.user_agent sticky buffer confines content to that field so it cannot match in the URI; nocase handles casing. The rule will also fire on legitimate PowerShell, so pair it with rarity or threat-intel context before escalating.

Traps

  • Writing content with no buffer and accidentally matching the whole payload.
  • Reversing direction so egress traffic never matches.
  • Reusing a sid or forgetting to bump rev.
  • Expecting drop to work on a sensor running in IDS mode.