<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: validating-network-detection-rules
description: >-
  Test and validate network-level detection rules using Zeek, Suricata, and
  Sigma. Covers packet replay, IDS rule validation, DNS/HTTP anomaly detection,
  and network-based ATT&CK technique coverage assessment.
domain: cybersecurity
subdomain: purple-team
tags:
  - network-detection
  - zeek
  - suricata
  - ndr
  - ids
  - pcap
  - sigma
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1071"]
---

# Validating Network Detection Rules

## Overview

Network detection rules catch adversary activity at the network layer — C2
beaconing, lateral movement, data exfiltration, and protocol abuse. This skill
validates Suricata rules and Zeek scripts against captured or replayed traffic,
measures detection coverage for network-based ATT&CK techniques, and tests
for evasion blind spots.

## Prerequisites

| Requirement | Install |
|---|---|
| Suricata | `apt install suricata` or Docker |
| Zeek | `apt install zeek` or Docker |
| tcpreplay | `apt install tcpreplay` |
| sigma-cli | `pip install sigma-cli` |
| Python 3.10+ | For agent tooling |
| Sample PCAPs | Known-bad traffic captures |

## Key Concepts

### Network Detection Sources

| Source | Format | ATT&CK Coverage |
|---|---|---|
| Suricata | ET/Suricata rules | T1071 (App Layer Protocol), T1095 (Non-App Layer) |
| Zeek | Zeek scripts/logs | T1048 (Exfiltration), T1572 (Tunneling) |
| DNS logs | Zeek dns.log | T1071.004 (DNS), T1568 (Dynamic Resolution) |
| HTTP logs | Zeek http.log | T1071.001 (Web), T1105 (Ingress Tool Transfer) |
| TLS logs | Zeek ssl.log | T1573 (Encrypted Channel), JA3/JA4 fingerprinting |

### Suricata Rule Format

```
alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"ET MALWARE Cobalt Strike Beacon C2";
  flow:established,to_server;
  content:"GET"; http_method;
  content:"/pixel.gif"; http_uri;
  sid:2030001; rev:1;
  metadata: attack_target Client, mitre_attack_tactic Command_And_Control, mitre_attack_technique T1071_001;
)
```

## Workflow

### 1. Replay Traffic Against Rules

```bash
# Replay PCAP through Suricata
suricata -r malware-c2.pcap -l /tmp/suricata-test/ -S custom-rules.rules

# Check alerts
cat /tmp/suricata-test/fast.log
jq . /tmp/suricata-test/eve.json | grep "alert"

# Replay through Zeek
zeek -r malware-c2.pcap local
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p
```

### 2. Validate Suricata Rules

```bash
# Syntax check
suricata -T -S custom-rules.rules -c /etc/suricata/suricata.yaml

# Test against known-bad PCAP
node scripts/agent.js test-suricata \
  --rules custom-rules.rules \
  --pcap samples/cobalt-strike-beacon.pcap \
  --expected-sids 2030001,2030002

# Test against benign PCAP (false positive check)
node scripts/agent.js test-suricata \
  --rules custom-rules.rules \
  --pcap samples/normal-browsing.pcap \
  --expect-clean
```

### 3. Validate Zeek Detection Scripts

```bash
# Run Zeek script against PCAP
zeek -r dns-tunnel.pcap scripts/detect-dns-tunnel.zeek
cat notice.log | zeek-cut note msg

# Batch validate network detection coverage
node scripts/agent.js batch-test \
  --techniques T1071.001,T1071.004,T1048.003,T1572 \
  --pcap-dir samples/ \
  --output network-coverage.json
```

## Detection

```yaml
title: Validating Network Detection Rules Detection
id: bde76337-1407-4ec5-aa75-101ceab2688b
status: experimental
description: Detects suspicious activity related to validating network detection rules techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*validating*network*"
  condition: selection
level: medium
tags:
  - attack.t1071
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Suricata rules parse | `suricata -T -S rules.rules` exits 0 |
| True positives | Expected SIDs fire on known-bad PCAPs |
| True negatives | No alerts on benign traffic PCAPs |
| Zeek logs generated | Expected log files (conn, dns, http) produced |
| Coverage mapped | Network techniques have detection rules |

## References

- [Suricata Documentation](https://docs.suricata.io/)
- [Zeek Documentation](https://docs.zeek.org/)
- [Emerging Threats Ruleset](https://rules.emergingthreats.net/)
- [PCAP Repositories](https://www.malware-traffic-analysis.net/)
