<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-network-detection-signatures
description: >-
  Build and deploy network detection signatures for protocol anomalies, lateral movement, data exfiltration, and encrypted traffic analysis using Zeek and packet inspection.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - network-detection
  - zeek
  - packet-analysis
  - protocol-anomaly
  - lateral-movement
  - traffic-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071"]
---

# Building Network Detection Signatures

## Overview

Network detection signatures identify threats at the network layer through
protocol analysis, traffic patterns, and behavioral indicators.
Covers Zeek scripting, JA3/JA4 fingerprinting, DNS analytics, and flow analysis.

## Prerequisites

| Requirement | Purpose |
|---|---|
| zeek | `apt install zeek` |
| tshark | Packet capture analysis |
| pcap samples | Network captures for testing |

## Key Concepts

### Zeek Detection Script

```zeek
# Zeek script for DNS tunneling detection
@load base/frameworks/notice

module DNSTunnel;

export {
    redef enum Notice::Type += {
        DNS_Tunnel_Detected
    };
    const query_length_threshold = 50 &redef;
    const query_count_threshold = 100 &redef;
    const monitoring_interval = 5min &redef;
}

global dns_query_tracker: table[addr] of count
    &create_expire=monitoring_interval &default=0;

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count)
{
    if ( |query| > query_length_threshold )
    {
        ++dns_query_tracker[c$id$orig_h];
        if ( dns_query_tracker[c$id$orig_h] > query_count_threshold )
            NOTICE([$note=DNS_Tunnel_Detected,
                    $conn=c,
                    $msg=fmt("DNS tunneling from %s: %d long queries",
                             c$id$orig_h, dns_query_tracker[c$id$orig_h])]);
    }
}
```

## Workflow

1. **Identify network threat** — Define traffic pattern or protocol abuse to detect
2. **Analyze protocol** — Study protocol specification and expected behavior
3. **Author signature** — Write Zeek script, BPF filter, or protocol decoder
4. **Test with captures** — Replay pcap files and validate detection accuracy
5. **Baseline traffic** — Profile normal network behavior for tuning
6. **Optimize performance** — Ensure signature handles line-rate traffic
7. **Deploy to sensors** — Push to network monitoring infrastructure

## Detection

```yaml
title: Network Detection Signatures Detection
id: ed3d28d2-a303-4128-85be-e48d5e4e5582
status: experimental
description: Detects suspicious activity related to building network detection signatures techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*network*"
  condition: selection
level: medium
tags:
  - attack.t1071
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
