<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ids-rules
description: >-
  Write, tune, and deploy Suricata and Snort IDS/IPS rules for network threat detection including custom signatures, threshold tuning, performance optimization, and false positive management.
domain: cybersecurity
subdomain: network-security
tags:
  - suricata
  - snort
  - ids
  - ips
  - signatures
  - detection-rules
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1190", "T1071", "T1095"]
  nist-csf: ["DE.CM-1", "DE.AE-2", "DE.AE-5"]
  uuid: 3dfa303b-a0cd-4b25-ae2c-f37fd0c629cf
---

# Implementing IDS Rules

## Overview

IDS/IPS rules are the backbone of network-level threat detection. Writing effective rules
requires understanding protocol parsers, content matching, flow tracking, and performance
implications. This skill covers Suricata rule syntax, protocol-specific keywords, threshold
tuning, performance optimization, and operational deployment patterns.

Mode: `[MODE: BLUE]` for rule writing; `[MODE: PURPLE]` for detection coverage mapping.

## Prerequisites

| Requirement | Details |
|---|---|
| Suricata 7.0+ or Snort 3.0+ deployed on network tap/span | Required |
| ET Open or ET Pro ruleset as baseline | Required |
| Understanding of network protocols (TCP/IP, HTTP, TLS, DNS) | Required |
| EVE JSON logging enabled for alert analysis | Required |
| Rule management tool (suricata-update, PulledPork) | Required |

## Key Concepts

### Suricata Rule Anatomy

```
action proto src_ip src_port -> dst_ip dst_port (options)

# Full example:
alert http $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Webshell upload detected - PHP in POST body"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.request_body; content:"<?php"; \
  content:"eval("; distance:0; \
  classtype:web-application-attack; \
  sid:3000001; rev:1; \
  metadata:attack_target Server, deployment Perimeter, \
  mitre_attack_tactic TA0001, mitre_attack_technique T1190;)
```

### Key Rule Keywords

```yaml
# Flow keywords
flow:established,to_server    # Client-to-server established
flow:established,to_client    # Server-to-client established

# Content matching
content:"malware";            # Exact match
content:"|de ad be ef|";      # Hex match
content:"cmd"; nocase;        # Case-insensitive
content:"exec"; offset:10; depth:20;  # Bounded search
content:".php"; distance:0; within:10; # Relative to last match

# Protocol-specific (Suricata)
http.uri; content:"/admin";   # HTTP URI inspection
http.header; content:"Bot";   # HTTP header
tls.sni; content:"evil.com";  # TLS SNI
dns.query; content:".xyz";    # DNS query name

# PCRE
pcre:"/\/[a-f0-9]{32}\.php/i";  # Regex match

# Thresholds
threshold:type both, track by_src, count 5, seconds 60;
```

### Production Rule Examples

```yaml
# Detect reverse shell over TCP
alert tcp $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Reverse shell - /bin/sh spawn"; \
  flow:established,to_server; \
  content:"/bin/sh"; content:"-i"; distance:0; within:5; \
  classtype:trojan-activity; \
  sid:3000010; rev:1;)

# Detect Cobalt Strike HTTP beacon
alert http $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Cobalt Strike beacon - default URI pattern"; \
  flow:established,to_server; \
  http.uri; pcre:"/^\/[a-zA-Z0-9]{4}$/"; \
  http.header; content:"Cookie:"; \
  pcre:"/Cookie:\s+[a-zA-Z]+=(?:[A-Za-z0-9+\/]{50,})/"; \
  threshold:type both, track by_src, count 3, seconds 300; \
  sid:3000011; rev:1;)

# Detect SQL injection in HTTP
alert http any any -> $HOME_NET any ( \
  msg:"SQL Injection attempt in URI"; \
  flow:established,to_server; \
  http.uri; pcre:"/(?:union\s+select|or\s+1\s*=\s*1|and\s+1\s*=\s*1|'\s*or\s*')/i"; \
  classtype:web-application-attack; \
  sid:3000012; rev:1;)

# Detect data exfiltration - large outbound transfer
alert tcp $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Large outbound data transfer - possible exfiltration"; \
  flow:established,to_server; \
  dsize:>10000; \
  threshold:type both, track by_src, count 100, seconds 60; \
  sid:3000013; rev:1;)
```

### Performance Optimization

```yaml
# Rule ordering (fast_pattern)
# Suricata auto-selects fast_pattern but you can force it:
content:"malware-signature"; fast_pattern;  # Use this for MPM matching

# Avoid expensive rules:
# BAD: pcre only (no content anchor)
alert tcp any any -> any any (pcre:"/secret/i"; sid:999;)
# GOOD: content + pcre
alert tcp any any -> any any (content:"secret"; nocase; pcre:"/secret\d+/i"; sid:999;)
```

## Workflow

### Step 1: Identify Detection Gap

Map MITRE ATT&CK technique to required network visibility. Determine protocol and traffic pattern.

### Step 2: Write Rule

```bash
# Write rule to file
cat >> /etc/suricata/rules/custom.rules << 'EOF'
alert http $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Custom - suspicious user agent"; \
  flow:established,to_server; \
  http.user_agent; content:"python-requests"; \
  threshold:type both, track by_src, count 10, seconds 300; \
  sid:3000020; rev:1;)
EOF
```

### Step 3: Validate and Test

```bash
# Syntax check
suricata -T -c /etc/suricata/suricata.yaml -S /etc/suricata/rules/custom.rules

# Test against PCAP
suricata -r test_traffic.pcap -c /etc/suricata/suricata.yaml -l /tmp/test_output/

# Check alerts
cat /tmp/test_output/eve.json | jq 'select(.event_type=="alert")'
```

### Step 4: Tune Thresholds

```yaml
# suppress.yaml — reduce false positives
suppress:
  - gen_id: 1
    sig_id: 3000020
    track: by_src
    ip: 10.10.20.0/24  # Dev team uses python-requests legitimately

# threshold.yaml — rate limiting
threshold:
  - gen_id: 1
    sig_id: 3000020
    type: both
    track: by_src
    count: 50
    seconds: 3600
```

### Step 5: Deploy to Production

```bash
# Reload rules without restart
kill -USR2 $(pidof suricata)
# Or use suricatasc
suricatasc -c reload-rules
```

## Detection

```yaml
title: Ids Rules Detection
id: a1eaf0f7-8a31-42d9-a5b2-a9feb1d426b7
status: experimental
description: Detects suspicious activity related to implementing ids rules techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1071
  - attack.t1095
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Ids Rules Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190, T1071, T1095 |

## Verification

- [ ] Rule syntax validated with suricata -T
- [ ] Rule tested against known-bad PCAP (true positive)
- [ ] Rule tested against normal traffic (false positive rate)
- [ ] Threshold tuned to operational alert volume
- [ ] Rule documented with MITRE ATT&CK mapping
- [ ] Suppress list configured for known legitimate sources
- [ ] Performance impact measured (rule profiling)
- [ ] Rule added to version control

## References

- [Suricata Rule Documentation](https://docs.suricata.io/en/latest/rules/)
- [Emerging Threats Open Ruleset](https://rules.emergingthreats.net/)
- MITRE ATT&CK for Network Detection
- SANS SEC503: Intrusion Detection In-Depth
