Скачать или смотреть NullMixer Network Detection - Crafting Custom IDS Rules with Suricata

While monitoring and alerting on network traffic can be incredibly useful, you can enhance that capability by adding your own custom IDS rules. In this video, we'll look into the Nullmixer traffic and craft a custom rule for detection. We'll take about rule syntax basics, how to identify patterns in the traffic and a rudimentary process for rule development and testing. By the end of this video, you'll have insight into how to craft your own custom IDS rules.

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 https://www.pluralsight.com/authors/j...
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻   / joshstroschein  
🌎 Follow me 👉🏻   / jstrosch  ,   / joshstroschein  
⚙️ Tinker with me on Github 👉🏻 https://github.com/jstrosch

icymi - this video discusses the network traffic we'll be analyzing along with the basics of using Suricata and Evebox:    • Investigating NullMixer Network Traffic: I...  

Tools: Suricata, EveBox, Wireshark

00:00 Introduction
01:45 Viewing the Traffic with Wireshark
06:34 Custom Script to Test the Rule
08:52 Writing a Custom Rule
18:04 Testing the Custom Rule