A collection of custom Snort 3.12 rules designed for proactive network threat detection. Features custom rules for alerting on specific traffic patterns and demonstrating IPS/IDS capabilities in virtualized environments.
This rule alerts on ICMP traffic to 8.8.8.8 from any source address. I used the --daq-batch-size parameter to print every packet to the console one by one. This is a way to use Snort as an IDS, alerting you but not taking any action to prevent malicious activity.
This rule alerts on incoming HTTPS traffic (port 443) to any port on the host address. When I used curl to make a GET request to google.com, Snort did not alert on the traffic because it was over HTTP, not HTTPS.
When I made the request to https://google.com, Snort correctly alerted the traffic in the console.
Instead of writing alerts to the console, this rule logs incoming DNS traffic which can then be viewed inside Wireshark.
Using Snort to log traffic, you can then open those files inside Wireshark for further analysis
Sometimes logging isn't enough and you want to drop certain traffic. This rule drops incoming ICMP traffic originating from any address. By actively dropping the packets, this turns Snort from an IDS into an IPS, allowing it to take action on your network.
For the purposes of this lab, 8.8.8.8 was used as the 'malicious' IP address. This rule is rejecting ICMP traffic from this IP which we are then alerting in the console. As you can see below, 4 packets were transmitted and we had 100% packet loss due to the reject rule. Because we are rejecting, only one packet is output to the console because the session gets terminated.
