NSM and Virtual Labbing Mega-Thread
In talking to some of the seniors in charge around here, I asked about sharing some old blog posts I did for my job over at the Emerging Threats Discourse , and while technically much of what I wrote does have to do with threat intelligence, it isn’t about a particular threat, more than it is about learning how to do various things related to threat research, detection engineering, NSM stuff, and homelabbing.
So ultimately, this is what I wanted to do:
-
Use this thread to link to some of my previous written works, and current projects related to NSM (Network Security Monitoring), Security Reseach, Detection Engineering, Homelabbing, etc.
-
Maybe Re-doing some of those posts and updating them specifically for IFIN
-
Solicit feedback for things I’m working on currently or future projects.
With all that out of the way, let’s get started
Previous works
Detection Exercise: D-Link DIR-513 (CVEs: 2025-8184, 8169, and 8168 : At the time, we had a new intern on our team who did not have the benefit of having years of experience writing rules for Snort and Suricata. So I took some time to write up “quick start” guide on how to get started with Snort and Suricata. Where the documentation is, How rule structure works, breaking down each section of a rule I put together for detection a buffer overflow against D-Link IoT routers, and being a good steward to the community and Archiving blog posts, write-ups proof of concept code, and anything else you rely on for detection engineering as you come across it.
Come Sail the CVEs Part 1 : Data Acquisition This is a two-part blog post I wrote that details some of the resources I use for threat research. The part 1 blog is basically a data dump of RSS feeds I’ve gathered at work from co-workers, and from the internet at large.
But friend da_667, everyone does that. Everyone has an intel feed. What makes yours different?
Well, I cover some cool tricks that aren’t quite as well known. Like, did you know that you can create an RSS feed from individual mastodon users? What about turning a reddit user’s posts or an entire subreddit’s posts into an RSS feed? How about following the releases page of a github project to see the changes in the RSS feed when they happen? Come take a look if any of that sounds interesting.
P.S. I would be completely remiss if I didn’t mention that IFIN has a FreshRSS Instance with many of the same resources I called out in my blog post plus more probably. I’ll need to revisit my RSS feeds and do some cleanup, and cross-referencing what I had with what IFIN already has makes re-visiting this blog post in the future even more promising.
Come Sail the CVEs Part 2: Turning Data Into Rules A companion to the part 1 post above, in this post, I chose to write up how I use my RSS feeds to find up and coming vulnerabilities, CVEs, and associated proof-of-concept code, and how I turn that proof-of-concept code into Snort and Suricata rules with multiple real-world examples, illustrations, etc.
Introduction to IOC Pivoting and the Pyramid of Pain: Somewhat related to Come Sail the CVEs part 1, this is another blog post that is mostly about Threat research, and a variety of non-RSS resources that I use as a part of my job. We briefly talk about the threat intel pyramid of pain, and how even the lowest “least useful” IOCs on the pyramid can become essential through data pivoting when it comes to detection engineering.
Flexible Rule Writing: Seeing Around the Bend: Some what related to the IOC Pivoting blog post, this is a post about how when I write rules for Suricata and Snort, I do so with “flexibility” in mind, in order to help the rules last a bit longer, be slightly more resilient to minor changes, and cast a wider net to get more possible results.
Games and Myths: Mythstealer Spotted in the Wild: This is a blog post that demonstrates data pivoting used to develop detection for Mythstealer. What started as a post on reddit, eventually turned into me find the sample, acquiring a decrypted pcap, decoding the obfuscated data exfiltration formatting they used, and uncovering related C2 infrastructure.
ET_INFO and Honeytoken Rules Webinar: Some of the rules and rule categories providing in the Emerging Threats ruleset for Snort and Suricata aren’t for detecting specific threats, but more for detecting “known things” or things that, in the right context could identify potentially bad activity – DNS lookups to particular services, TLS Server Name Indicators to the same services, RMM software, etc. I also detailed out some ideas on how to use your IDS/IPS platform as a sort of Honeypot by creating IDS rules that identify “honeytokens” or looking for exfiltrated information for important hosts like machine guids, hostnames, MAC addresses, CPU arch, etc.
I did a webinar for OISF (that was originally going to be a Suricon talk, but I got sick literally the day before I was slated to leave) and this blog post has links to the video for those who want to listen to it in the background, as well as links to a github repo that has the power point slides, etc.
Building Virtual Machine Labs: Second Edition: Do you want to build your own homelab? I wrote this book a few years back, some some of the data is slightly dated, but for the most part, the hypervisors have not changed, the concepts haven’t changed, and for the most part, the steps for configuring a baseline virtual lab haven’t changed that much, either. Yes, this is a book, and yes there is a price tag on the page, but the price of the book is pay what you want and the minimum price can be set to free. Because knowledge wants to be free.
Looking for an alternative? Consider checking out @mttaggart 's Homelab Almanac , NGL, when I’m ready to write a third edition, I will very likely be working with him to compare notes.
Current Work
Suricata: An Operator’s Guide (Draft): Another book of mine that is pay what you want, this one is focused on the ins and outs of Suricata, and is a work in progress – as in, I’m not finished with it, but I wanted to make drafts available as I write it in order to get feedback from readers on things that aren’t clear, and stuff they would like to see covered, so please take this as an invitation to take a look and offer any kind of feedback to help make this book the best it can be.
Okay, but what does it actually cover?
So far, I have 9 chapters written. This book covers:
- the history of Suricata
- A general guide on how to set up a threat research/detection engineering virtual lab, with multiple variations to support multiple budgets
- A chapter about how sensor placement greatly affects its ability to detect threats
- A chapter on the anatomy of a suricata rule – headers, rule body, and the general categorization of all the various keywords available in suricata
- A chapter dedicated to measuring rule performance and factors that affect how well a Suricata rule will perform
- A chapter dedicated to enumerating a wide variety of threat research resources with an express goal of helping readers become better detection engineers to write their own rules as necessary
- A chapter dedicated to vulnerability research, and resources again with the express goal of helping readers develop their own Suricata rules from their research.
- Real-world scenario exercises that readers can follow for both the vulnerability research, and threat research chapters – 3 scenarios each (six in total). Learn how I started with data I pulled from my RSS feeds, and eventually turned them into Suricata rules
- A wrap-up chapter for both the threat and vulnerability research exercise chapters that feature even more resources readers can utilize towards vulnerability research, threat research, honeypots, etc.
okay, and what are you working on or planning to add to it?
- The chapter I’m currently working on is laser-focused on methods and techniques for dealing with TLS encrypted traffic. How do I find DNS over HTTPS? How do I deal with Encrypted Client Hello? What are non-invasive ways of analyzing TLS traffic? What are the invasive methods and how to I implement them? There are a lot of people who have, repeatedly, declared IDS/IPS a dead technology because of TLS encryption. As always, they are wrong and we can prove it together.
- A chapter on methods for noise reduction: pass rules, bpf, rule modification etc.
- Interesting tips and tricks for rule writing picked up from years as an Emerging Threats rule writer
- [insert thing you want me to write about here]
Okay, that’s all I have for now. If you have questions, comments, concerns, etc. Ask them here, or find me on Mastodon (@da_667@infosec.exchange).
Happy Hunting,
-Tony “da_667” Robinson