NullMixer Network Detection - Crafting Custom IDS Rules with Suricata

While monitoring and alerting on network traffic can be incredibly useful, you can enhance that capability by adding your own custom IDS rules. In this video, we'll look into the Nullmixer traffic and craft a custom rule for detection. We'll take about rule syntax basics, how to identify patterns in the traffic and a rudimentary process for rule development and testing. By the end of this video, you'll have insight into how to craft your own custom IDS rules. Cybersecurity, reverse engineering, malware analysis and ethical hacking content! 🎓 Courses on Pluralsight 👉🏻 https://www.pluralsight.com/authors/j... 🌶️ YouTube 👉🏻 Like, Comment & Subscribe! 🙏🏻 Support my work 👉🏻   / joshstroschein   🌎 Follow me 👉🏻   / jstrosch  ,   / joshstroschein   ⚙️ Tinker with me on Github 👉🏻 https://github.com/jstrosch icymi - this video discusses the network traffic we'll be analyzing along with the basics of using Suricata and Evebox:    • Investigating NullMixer Network Traffic: I...   Tools: Suricata, EveBox, Wireshark 00:00 Introduction 01:45 Viewing the Traffic with Wireshark 06:34 Custom Script to Test the Rule 08:52 Writing a Custom Rule 18:04 Testing the Custom Rule