Snort and Suricata

What Snort and Suricata Are and How IDS/IPS Rules Work

• Snort and Suricata are open-source Network Intrusion Detection and Prevention Systems (NIDS/NIPS).
• They inspect network traffic in real time, matching packets against a ruleset, and generate alerts when traffic matches a rule.
• Snort, originally released in 1998 by Martin Roesch and now maintained by Cisco, is the reference implementation.
• Suricata, developed by the Open Information Security Foundation (OISF), is a modern alternative with multi-threaded performance, built-in file extraction, and protocol parsing beyond simple pattern matching.

Rule Structure — The Anatomy of a Signature

Every Snort/Suricata rule follows the same structure:

[action] [protocol] [src_ip] [src_port] -> [dst_ip] [dst_port] ([rule options])

Example Rule — Detecting a PowerShell Download

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
  msg:"MALWARE-CNC Win.Trojan.PowerShell download attempt";
  flow:to_server,established;
  content:"powershell"; nocase;
  content:"Invoke-Expression"; nocase;
  content:"DownloadString"; nocase;
  sid:1000001;
  rev:1;
  priority:1;
)

Breaking Down the Rule Components

Rule Writing Patterns — Common Detection Logic

Single Content Match — Simple

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (
  msg:"MALWARE-CNC Cobalt Strike beacon";
  content:"|00 00 00 00 00 00 00 00|";
  sid:1000002;
  rev:1;
)

When to use: A unique byte sequence that is reliably present in the attack traffic (e.g., Cobalt Strike beacons) and not in legitimate traffic. Risky — high false positive potential if the sequence appears in benign payloads.

Multi-Content Match — Recommended

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
  msg:"MALWARE-CNC Metasploit staging payload";
  content:"Meterpreter"; nocase;
  content:"Stage"; nocase;
  distance:1; within:10;
  sid:1000003;
  rev:1;
)

When to use: The recommended approach — match multiple strings within a proximity window, useful for Metasploit staging traffic. Reduces false positives significantly.

PCRE (Perl-Compatible Regular Expression)

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (
  msg:"MALWARE-CNC Suspicious HTTPS beacon";
  pcre:"/(?:Meterpreter|Beacon|Sliver|Covenant)/";
  sid:1000004;
  rev:1;
)

When to use: Regular expression matching for complex patterns. Performance impact — avoid PCRE with expensive lookaheads/lookbehinds in high-traffic environments.

Flowbit — Stateful Detection

alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (
  msg:"WEB-ATTACKS SQL injection attempt";
  content:"UNION SELECT"; nocase;
  flowbits:set,sqli_attempt;
  flowbits:noalert;
  sid:1000005;
  rev:1;
)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (
  msg:"WEB-ATTACKS SQL injection with data exfiltration";
  flowbits:isset,sqli_attempt;
  content:"200 OK";
  flowbits:unset,sqli_attempt;
  sid:1000006;
  rev:1;
)

When to use: Stateful detection across multiple packets. First rule “sets” a bit if SQLi is attempted; second rule alerts only if the attack also results in a successful response.

Tuning Rules — Reducing False Positives

A fresh Snort/Suricata installation with Emerging Threats rules will generate thousands of alerts per day. Tuning is not optional.

Tuning Workflow

1. Install and run in alert-only (IDS) mode — do not enable IPS until you understand your baseline.
2. Generate a baseline — collect alerts for 1-2 weeks during normal operations. Tag each alert as TP (True Positive: actual security event), FP (False Positive: noise), or TN (True Negative: benign activity that matched a poorly-written rule).
3. Modify rules — three approaches:

4. Test in staging — replay traffic through the updated ruleset and verify FP reduction.
5. Enable IPS mode selectively — start by dropping the highest-confidence rules (critical severity, unique signatures).

Common High-FP Rule Categories

Detection Workflow — Alert Triage

When an alert fires, here is the standard triage:

Suricata-Specific Features

Suricata has features Snort does not — useful for modern detection:

Related

• Wireshark — detection and response for T1040 techniques
• Zeek (formerly Bro) — detection and response for T1040 techniques
• Network Security Basics — detection and response for T1040, T1046 techniques

Sources

• Suricata User Guide
• Snort Users Manual
• Emerging Threats Rules
• MITRE ATT&CK T1040
• SANS — IDS Tuning