CMM7XX

Intrusion Detection Systems

Session 9: Monitoring and Alerts

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Differentiate NIDS/HIDS architectures and their deployment strategies.
  • Evaluate Signature vs Anomaly vs Heuristic detection engines.
  • Understand the statistical implications of the Base Rate Fallacy in IDS.
  • Write and analyze complex Suricata/Snort network rules.
  • Deconstruct SIEM architectures and construct correlation queries for Threat Hunting.

Introduction to Task 1

Writing precise NIDS rules is essential to catching advanced threats without flooding the SOC with false positives.

We will write rules for Suricata, a modern multi-threaded NIDS engine.
Practical Resource: MITRE ATT&CK Framework

Task 1: Writing Custom NIDS Rules

Timing: 45 minutes

An APT group uses a custom Command & Control (C2) beacon that sends an HTTP GET request containing the User-Agent "Mozilla/5.0 (EvilC2)" to port 8080 every exactly 5 minutes.

  1. Draft a Suricata rule to detect this specific User-Agent string exiting the internal network.
  2. Draft a second rule to detect the specific timing anomaly (beaconing behavior) if the User-Agent was randomized.
  3. Discuss the performance implications of deep packet inspection rules versus simple IP/Port rules.
Practical Resource: CyberChef: The Cyber Swiss Army Knife

15 Minute Break

Please return promptly for Part 2.

Part 2: SIEM & Threat Hunting

Duration: 1.5 Hours

Practical Resource: MITRE ATT&CK Framework

SIEM Architectures

Security Information and Event Management (SIEM) aggregates logs from firewalls, NIDS, HIDS, and servers into a single centralized database.

  • Collection: Forwarding logs (syslog, Winlogbeat) to the SIEM.
  • Parsing/Normalization: Converting different log formats into a standardized JSON schema (e.g., mapping src_ip across all vendors).
  • Correlation: The true power of a SIEM. Linking isolated events into an attack narrative (e.g., 5 failed logins on a VPN, followed by a successful login, followed by a large data transfer).
Practical Resource: Cheswick & Bellovin: Firewalls and Internet Security

Threat Hunting

Proactively searching through SIEM data to find threats that evaded the automated IDS rules.

  • Hypothesis-Driven: "I suspect attackers are using DNS tunneling for exfiltration. Let me query the SIEM for unusual DNS query lengths."
  • IoC-Driven: Threat intel releases a list of malicious IPs. Querying the SIEM retroactively to see if anyone communicated with them 3 months ago.

Integration: Often paired with SOAR (Security Orchestration, Automation, and Response) to automatically isolate compromised hosts.

Practical Resource: MITRE ATT&CK Framework

Introduction to Task 2

In a real Security Operations Center (SOC), analysts use query languages (like Splunk SPL or KQL) to sift through millions of events.

We will simulate a threat hunting scenario requiring the correlation of multiple log sources to confirm a breach.
Practical Resource: MITRE ATT&CK Framework

Task 2: Threat Hunting Correlation

Timing: 50 minutes

You have access to pseudocode SIEM query capabilities. Write correlation logic to detect the following attack chain:

  1. A user account experiences >10 failed login attempts from a foreign IP (Windows Event ID 4625).
  2. Within 5 minutes, that same user account successfully logs in (Event ID 4624).
  3. Within 10 minutes of the successful login, a new Scheduled Task is created on the endpoint (Event ID 4698).
  4. Write the logic to join these events. Discuss why this correlation drastically reduces the False Positive rate compared to alerting on failed logins alone.
Practical Resource: MITRE ATT&CK Framework

Summary & Next Steps

  • IDS provides the raw data; SIEM provides the context and correlation.
  • Alert Fatigue is a critical human vulnerability in SOCs. Rules must be tuned to minimize false positives using correlation.
Next Week: NIST Cyber Security Framework (Risk Assessment)
Practical Resource: Elastic Security Documentation