Network Level Cyber Attack Detection

Analyze network packets with Scapy and Wireshark to reveal payload structure and keywords like content, offset, and distance, identify attack patterns, and translate them into custom signatures for firewall detection.

Simulate malicious dns requests with scapy to study phishing domains and indicators of compromise, analyze dns packets, and build dynamic malware analysis techniques in a training environment.

Simulate ransomware traffic using Scapy, analyze malware dynamically with Remnux, and extract indicators of compromise from HTTP requests and user agent strings to guide detection rules.

Simulate spam and phishing traffic with Scapy and Inetsim, analyze SMTP and DNS interactions, and inspect packet payloads and logs using Wireshark in a lab environment.

Analyze SMB traffic payloads to detect malicious file transfers by inspecting SMB protocol exchanges, headers, and executable payloads, and extract transferred files with Wireshark, hex editor, or network-minus tool.

Analyze malicious and normal traffic by inspecting FTP and TFTP payloads, examining a target exploit, and generating alerts from full packet captures to guide incident response.

Analyze ssh traffic to detect tunneling and data exfiltration by examining encrypted ssh handshakes, port patterns, and certificates for indicators of compromise in incident response.

Create icmp payloads with scapy and inspect icmp and mysql nfs traffic to detect anomalous payload sizes, monitor continuous icmp traffic, and generate alerts for potential exfiltration.

Simulate a dns tunnel with a python script and scapy, generating random subdomains for data exfiltration and remote code execution. Analyze with wireshark and detect continuous, long subdomain dns queries.

Install snort and set up the detection engine and rules to defend against cyber attacks. Configure preprocessing, logging, and alerting, and manage home and external networks with local rules.

Explore Snort and Suricata keywords to build custom rules, use content, offset, and distance to inspect payloads, generate alerts, and optimize detection performance.

Create basic Snort rules to defend against cyber attacks by analyzing payloads, calculating offsets and depths, and generating alerts with custom signatures.

Learn to install Suricata, configure its rule paths, and create custom phishing signatures; analyze pcap data, generate alerts for PayPal dot com, and review JSON logs for incident response.

Create a ransomware detection signature by examining traffic indicators of compromise, such as fake user agents and http get payload patterns, to trigger alerts on external ransomware activity.

Learn to detect ransomware by building a signature from network traffic data, using indicators of compromise such as user agents, http payloads, and payload content to trigger alerts.

Learn to detect ssh tunnels and icmp tunnels, build incident-response signatures, and alert on exfiltration by analyzing endpoint and network connections for pivot-point threats.

Detect icmp tunnels and identify icmp tunnel incidents within networks by analyzing payload length, timing, and signatures to generate alerts for anomalous icmp traffic.

Detect DNS tunnel activity by analyzing packet counts, destination patterns, and domain length; implement signatures and thresholds to alert beaconing and tunneling in network traffic.

Learn zero-day exploit detection by analyzing exploit patterns in network traffic and creating custom Shorouk rules to identify classic buffer overflow signatures.

Develop custom circuit rules and signatures to detect remote code execution exploits, analyze packets and return addresses, and identify public exploits in network traffic.

Develop environment-variable based signatures to detect shellshock exploits at the network level by analyzing packets, using user agent and cgi pattern matching to trigger alerts.

Develop rules to detect sql injection artifacts in network traffic, using wireshark filters and http get requests, tuning signatures to reduce false positives and identify union select patterns.

Detect web shell artifacts on network traffic by building simple signatures and rules to reduce false positives. Analyze traffic with Wireshark to extract indicators and test signatures for IOC detection.

Detect sql lfi rfi artifacts in network traffic by applying pattern-based signatures, inspecting metadata, and triggering alerts with a simple ruleset.

Learn the basic usage of honeypots, monitor adversary behaviors, and detect brute force attempts using tools like Hydra, port scanning, and version detection in a controlled honeypot environment.

Osquery exposes the operating system as a high-performance relational database, enabling queries on processes, network connections, file hashes, and other OS data for incident analysis.