[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FDNPY6ZCG5ZY9RT074R3G":3,"skill-same:01M71FDNPY6ZCG5ZY9RT074R3G":54},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":14,"repositoryHtmlUrl":30,"repositoryHomepageUrl":6,"ownerHtmlUrl":31,"ownerBlogUrl":6,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M71FDNPY6ZCG5ZY9RT074R3G","net-ids-suricataips",null,"vars:","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-ids-suricataips\u002FSKILL.md",[],[19,20,21],"ids","net ids suricataips","cybersecurity","2026-11-10 10:12:30",false,"---\nname: net-ids-suricataips\ndescription: \"vars:\"\ndomain: cybersecurity\n---\nvars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8,172.16.0.0\u002F12,192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"[10.0.1.10\u002F32,10.0.1.11\u002F32]\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n  port-groups:\n    HTTP_PORTS: \"80\"\n    SHELLCODE_PORTS: \"!80\"\n    SSH_PORTS: \"22\"\n    DNS_PORTS: \"53\"\n\n# IPS mode with NFQUEUE\nnfq:\n  mode: accept\n  repeat-mark: 1\n  repeat-mask: 1\n  route-queue: 2\n  fail-open: yes\n\n# Threading configuration\nthreading:\n  set-cpu-affinity: yes\n  cpu-affinity:\n    - management-cpu-set:\n        cpu: [0]\n    - receive-cpu-set:\n        cpu: [1,2]\n    - worker-cpu-set:\n        cpu: [3,4,5,6,7]\n        mode: exclusive\n\n# Detection engine\ndetect-engine:\n  - profile: high\n  - custom-values:\n      toclient-groups: 50\n      toserver-groups: 50\n  - sgh-mpm-context: auto\n  - inspection-recursion-limit: 3000\n\n# Stream engine\nstream:\n  memcap: 512mb\n  checksum-validation: yes\n  inline: auto\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Logging configuration\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\n      types:\n        - alert:\n            payload: yes\n            payload-buffer-size: 4kb\n            payload-printable: yes\n            packet: yes\n            metadata: yes\n            tagged-packets: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - flow\n        - netflow\n        - stats:\n            totals: yes\n            threads: no\n            deltas: yes\n\n  - fast:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log\n\n  - stats:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n      interval: 30\n\n# Rule files\ndefault-rule-path: \u002Fvar\u002Flibs\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n```\n\n### Step 3: Configure NFQUEUE for Inline IPS\n\nSet up iptables to redirect traffic through Suricata:\n\n```bash\n# Enable IP forwarding\necho 1 > \u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\n\n# Redirect FORWARD chain to NFQUEUE\nsudo iptables -I FORWARD -j NFQUEUE --queue-num 0 --queue-bypass\n\n# For multi-queue (better performance)\nsudo iptables -I FORWARD -j NFQUEUE --queue-balance 0:3 --queue-bypass\n\n# Save iptables rules\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\nAlternative: AF_PACKET inline mode between two interfaces:\n\n```yaml\n# In suricata.yaml\naf-packet:\n  - interface: eth0\n    cluster-id: 98\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth1\n  - interface: eth1\n    cluster-id: 97\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth0\n```\n\n### Step 4: Manage Rules with Suricata-Update\n\n```bash\n# Update rules from default sources (ET Open)\nsudo suricata-update\n\n# List available rule sources\nsudo suricata-update list-sources\n\n# Enable ET Pro (requires license key)\nsudo suricata-update enable-source et\u002Fpro secret-code=YOUR_OINKCODE\n\n# Enable additional sources\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\nsudo suricata-update enable-source sslbl\u002Fssl-fp-blacklist\n\n# Disable specific rules that generate false positives\necho \"2100498\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\necho \"group:emerging-policy.rules\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\n\n# Modify rule actions (change alert to drop)\necho 're:ET MALWARE' >> \u002Fetc\u002Fsuricata\u002Fmodify.conf\n\n# Apply updates\nsudo suricata-update --reload-command=\"suricatasc -c reload-rules\"\n```\n\n### Step 5: Write Custom Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Flocal.rules`:\n\n```\n# Detect potential reverse shell over TCP\ndrop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Potential Reverse Shell - \u002Fbin\u002Fbash in payload\"; flow:to_server,established; content:\"\u002Fbin\u002Fbash\"; content:\"-i\"; within:20; classtype:trojan-activity; sid:1000001; rev:1;)\n\n# Block known malicious user agent\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Malicious User-Agent - Cobalt Strike\"; http.user_agent; content:\"Mozilla\u002F5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| WOW64|3b| Trident\u002F5.0)\"; classtype:trojan-activity; sid:1000002; rev:1;)\n\n# Detect DNS query for known DGA domain pattern\nalert dns $HOME_NET any -> any 53 (msg:\"LOCAL Suspicious DGA Domain Query\"; dns.query; content:\".top\"; pcre:\"\u002F^[a-z0-9]{12,30}\\.(top|xyz|club|online|site)$\u002F\"; classtype:bad-unknown; sid:1000003; rev:1;)\n\n# Detect large DNS TXT response (potential C2)\nalert dns any 53 -> $HOME_NET any (msg:\"LOCAL Large DNS TXT Response - Potential C2\"; dns.opcode:0; content:\"|00 10|\"; byte_test:2,>,500,0,relative; classtype:bad-unknown; sid:1000004; rev:1;)\n\n# Block outbound traffic to Tor exit nodes\ndrop tcp $HOME_NET any -> [100.2.18.10,104.244.76.13,109.70.100.1] any (msg:\"LOCAL Outbound Connection to Known Tor Exit Node\"; classtype:policy-violation; sid:1000005; rev:1;)\n\n# Detect SMB lateral movement attempts\nalert tcp $HOME_NET any -> $HOME_NET 445 (msg:\"LOCAL Internal SMB Connection - Possible Lateral Movement\"; flow:to_server,established; content:\"|ff|SMB\"; offset:4; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-admin; sid:1000006; rev:1;)\n\n# Detect PowerShell download cradle\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL PowerShell Download Cradle Detected\"; http.user_agent; content:\"PowerShell\"; nocase; http.method; content:\"GET\"; classtype:trojan-activity; sid:1000007; rev:1;)\n\n# Detect ICMP tunneling (large ICMP packets)\nalert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Oversized ICMP Packet - Possible Tunneling\"; dsize:>800; threshold:type both,track by_src,count 10,seconds 60; classtype:bad-unknown; sid:1000008; rev:1;)\n```\n\n### Step 6: Start Suricata in IPS Mode\n\n```bash\n# Test configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Start in NFQUEUE IPS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0\n\n# Start with AF_PACKET inline mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet\n\n# Start as systemd service\nsudo systemctl enable suricata\nsudo systemctl start suricata\n\n# Monitor performance stats\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n\n# Reload rules without restart\nsudo suricatasc -c reload-rules\n```\n\n## Monitoring and Tuning\n\n### Performance Metrics\n\n```bash\n# Check kernel drops\nsudo suricatasc -c dump-counters | grep -E \"capture.kernel_drops|decoder.pkts\"\n\n# Monitor EVE JSON alerts\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n\n# Check rule loading\ngrep -c \"rules loaded\" \u002Fvar\u002Flog\u002Fsuricata\u002Fsuricata.log\n\n# Memory usage\nsudo suricatasc -c dump-counters | grep memuse\n```\n\n### Tuning for False Positives\n\n```bash\n# Identify noisy rules\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature_id' | sort | uniq -c | sort -rn | head -20\n\n# Suppress specific rules per source\necho \"suppress gen_id 1, sig_id 2100498, track by_src, ip 10.0.5.0\u002F24\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n\n# Rate-limit alerts\necho \"rate_filter gen_id 1, sig_id 2100366, track by_src, count 10, seconds 60, new_action alert, timeout 300\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n```\n\n## Best Practices\n\n- **Start in IDS Mode** - Deploy in IDS (alert-only) mode first, tune for 2-4 weeks, then switch to IPS\n- **Fail-Open** - Configure fail-open mode so network traffic continues if Suricata crashes\n- **Rule Tuning** - Use threshold and suppress directives to reduce false positives before enabling drop actions\n- **CPU Affinity** - Pin Suricata worker threads to dedicated CPU cores for consistent performance\n- **Bypass for Trusted Traffic** - Use `pass` rules for known-good traffic to reduce processing load\n- **Regular Updates** - Run `suricata-update` daily via cron to keep signatures current\n- **Monitor Drops** - Track kernel packet drops and increase ring buffer size if needed\n\n## References\n\n- [Suricata Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002F)\n- [Suricata Rules Format](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Emerging Threats Rulesets](https:\u002F\u002Frules.emergingthreats.net\u002F)\n- [OISF Suricata GitHub](https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata)\n- [Suricata-Update Documentation](https:\u002F\u002Fsuricata-update.readthedocs.io\u002F)\n","vars:\n  address-groups:\n    HOME_NET: \"[10.0.0.0\u002F8,172.16.0.0\u002F12,192.168.0.0\u002F16]\"\n    EXTERNAL_NET: \"!$HOME_NET\"\n    HTTP_SERVERS: \"$HOME_NET\"\n    DNS_SERVERS: \"[10.0.1.10\u002F32,10.0.1.11\u002F32]\"\n    SMTP_SERVERS: \"$HOME_NET\"\n\n  port-groups:\n    HTTP_PORTS: \"80\"\n    SHELLCODE_PORTS: \"!80\"\n    SSH_PORTS: \"22\"\n    DNS_PORTS: \"53\"\n\n# IPS mode with NFQUEUE\nnfq:\n  mode: accept\n  repeat-mark: 1\n  repeat-mask: 1\n  route-queue: 2\n  fail-open: yes\n\n# Threading configuration\nthreading:\n  set-cpu-affinity: yes\n  cpu-affinity:\n    - management-cpu-set:\n        cpu: [0]\n    - receive-cpu-set:\n        cpu: [1,2]\n    - worker-cpu-set:\n        cpu: [3,4,5,6,7]\n        mode: exclusive\n\n# Detection engine\ndetect-engine:\n  - profile: high\n  - custom-values:\n      toclient-groups: 50\n      toserver-groups: 50\n  - sgh-mpm-context: auto\n  - inspection-recursion-limit: 3000\n\n# Stream engine\nstream:\n  memcap: 512mb\n  checksum-validation: yes\n  inline: auto\n  reassembly:\n    memcap: 1gb\n    depth: 1mb\n    toserver-chunk-size: 2560\n    toclient-chunk-size: 2560\n\n# Logging configuration\noutputs:\n  - eve-log:\n      enabled: yes\n      filetype: regular\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json\n      types:\n        - alert:\n            payload: yes\n            payload-buffer-size: 4kb\n            payload-printable: yes\n            packet: yes\n            metadata: yes\n            tagged-packets: yes\n        - http:\n            extended: yes\n        - dns:\n            query: yes\n            answer: yes\n        - tls:\n            extended: yes\n        - files:\n            force-magic: yes\n            force-hash: [md5, sha256]\n        - flow\n        - netflow\n        - stats:\n            totals: yes\n            threads: no\n            deltas: yes\n\n  - fast:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Ffast.log\n\n  - stats:\n      enabled: yes\n      filename: \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n      interval: 30\n\n# Rule files\ndefault-rule-path: \u002Fvar\u002Flibs\u002Fsuricata\u002Frules\nrule-files:\n  - suricata.rules\n```\n\n### Step 3: Configure NFQUEUE for Inline IPS\n\nSet up iptables to redirect traffic through Suricata:\n\n```bash\n# Enable IP forwarding\necho 1 > \u002Fproc\u002Fsys\u002Fnet\u002Fipv4\u002Fip_forward\n\n# Redirect FORWARD chain to NFQUEUE\nsudo iptables -I FORWARD -j NFQUEUE --queue-num 0 --queue-bypass\n\n# For multi-queue (better performance)\nsudo iptables -I FORWARD -j NFQUEUE --queue-balance 0:3 --queue-bypass\n\n# Save iptables rules\nsudo iptables-save > \u002Fetc\u002Fiptables\u002Frules.v4\n```\n\nAlternative: AF_PACKET inline mode between two interfaces:\n\n```yaml\n# In suricata.yaml\naf-packet:\n  - interface: eth0\n    cluster-id: 98\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth1\n  - interface: eth1\n    cluster-id: 97\n    cluster-type: cluster_flow\n    defrag: yes\n    use-mmap: yes\n    copy-mode: ips\n    copy-iface: eth0\n```\n\n### Step 4: Manage Rules with Suricata-Update\n\n```bash\n# Update rules from default sources (ET Open)\nsudo suricata-update\n\n# List available rule sources\nsudo suricata-update list-sources\n\n# Enable ET Pro (requires license key)\nsudo suricata-update enable-source et\u002Fpro secret-code=YOUR_OINKCODE\n\n# Enable additional sources\nsudo suricata-update enable-source oisf\u002Ftrafficid\nsudo suricata-update enable-source ptresearch\u002Fattackdetection\nsudo suricata-update enable-source sslbl\u002Fssl-fp-blacklist\n\n# Disable specific rules that generate false positives\necho \"2100498\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\necho \"group:emerging-policy.rules\" >> \u002Fetc\u002Fsuricata\u002Fdisable.conf\n\n# Modify rule actions (change alert to drop)\necho 're:ET MALWARE' >> \u002Fetc\u002Fsuricata\u002Fmodify.conf\n\n# Apply updates\nsudo suricata-update --reload-command=\"suricatasc -c reload-rules\"\n```\n\n### Step 5: Write Custom Rules\n\nCreate `\u002Fvar\u002Flib\u002Fsuricata\u002Frules\u002Flocal.rules`:\n\n```\n# Detect potential reverse shell over TCP\ndrop tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Potential Reverse Shell - \u002Fbin\u002Fbash in payload\"; flow:to_server,established; content:\"\u002Fbin\u002Fbash\"; content:\"-i\"; within:20; classtype:trojan-activity; sid:1000001; rev:1;)\n\n# Block known malicious user agent\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Malicious User-Agent - Cobalt Strike\"; http.user_agent; content:\"Mozilla\u002F5.0 (compatible|3b| MSIE 9.0|3b| Windows NT 6.1|3b| WOW64|3b| Trident\u002F5.0)\"; classtype:trojan-activity; sid:1000002; rev:1;)\n\n# Detect DNS query for known DGA domain pattern\nalert dns $HOME_NET any -> any 53 (msg:\"LOCAL Suspicious DGA Domain Query\"; dns.query; content:\".top\"; pcre:\"\u002F^[a-z0-9]{12,30}\\.(top|xyz|club|online|site)$\u002F\"; classtype:bad-unknown; sid:1000003; rev:1;)\n\n# Detect large DNS TXT response (potential C2)\nalert dns any 53 -> $HOME_NET any (msg:\"LOCAL Large DNS TXT Response - Potential C2\"; dns.opcode:0; content:\"|00 10|\"; byte_test:2,>,500,0,relative; classtype:bad-unknown; sid:1000004; rev:1;)\n\n# Block outbound traffic to Tor exit nodes\ndrop tcp $HOME_NET any -> [100.2.18.10,104.244.76.13,109.70.100.1] any (msg:\"LOCAL Outbound Connection to Known Tor Exit Node\"; classtype:policy-violation; sid:1000005; rev:1;)\n\n# Detect SMB lateral movement attempts\nalert tcp $HOME_NET any -> $HOME_NET 445 (msg:\"LOCAL Internal SMB Connection - Possible Lateral Movement\"; flow:to_server,established; content:\"|ff|SMB\"; offset:4; depth:4; threshold:type both,track by_src,count 5,seconds 60; classtype:attempted-admin; sid:1000006; rev:1;)\n\n# Detect PowerShell download cradle\ndrop http $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL PowerShell Download Cradle Detected\"; http.user_agent; content:\"PowerShell\"; nocase; http.method; content:\"GET\"; classtype:trojan-activity; sid:1000007; rev:1;)\n\n# Detect ICMP tunneling (large ICMP packets)\nalert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:\"LOCAL Oversized ICMP Packet - Possible Tunneling\"; dsize:>800; threshold:type both,track by_src,count 10,seconds 60; classtype:bad-unknown; sid:1000008; rev:1;)\n```\n\n### Step 6: Start Suricata in IPS Mode\n\n```bash\n# Test configuration\nsudo suricata -T -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml\n\n# Start in NFQUEUE IPS mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml -q 0\n\n# Start with AF_PACKET inline mode\nsudo suricata -c \u002Fetc\u002Fsuricata\u002Fsuricata.yaml --af-packet\n\n# Start as systemd service\nsudo systemctl enable suricata\nsudo systemctl start suricata\n\n# Monitor performance stats\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Fstats.log\n\n# Reload rules without restart\nsudo suricatasc -c reload-rules\n```\n\n## Monitoring and Tuning\n\n### Performance Metrics\n\n```bash\n# Check kernel drops\nsudo suricatasc -c dump-counters | grep -E \"capture.kernel_drops|decoder.pkts\"\n\n# Monitor EVE JSON alerts\ntail -f \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq 'select(.event_type==\"alert\")'\n\n# Check rule loading\ngrep -c \"rules loaded\" \u002Fvar\u002Flog\u002Fsuricata\u002Fsuricata.log\n\n# Memory usage\nsudo suricatasc -c dump-counters | grep memuse\n```\n\n### Tuning for False Positives\n\n```bash\n# Identify noisy rules\ncat \u002Fvar\u002Flog\u002Fsuricata\u002Feve.json | jq -r 'select(.event_type==\"alert\") | .alert.signature_id' | sort | uniq -c | sort -rn | head -20\n\n# Suppress specific rules per source\necho \"suppress gen_id 1, sig_id 2100498, track by_src, ip 10.0.5.0\u002F24\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n\n# Rate-limit alerts\necho \"rate_filter gen_id 1, sig_id 2100366, track by_src, count 10, seconds 60, new_action alert, timeout 300\" >> \u002Fetc\u002Fsuricata\u002Fthreshold.config\n```\n\n## Best Practices\n\n- **Start in IDS Mode** - Deploy in IDS (alert-only) mode first, tune for 2-4 weeks, then switch to IPS\n- **Fail-Open** - Configure fail-open mode so network traffic continues if Suricata crashes\n- **Rule Tuning** - Use threshold and suppress directives to reduce false positives before enabling drop actions\n- **CPU Affinity** - Pin Suricata worker threads to dedicated CPU cores for consistent performance\n- **Bypass for Trusted Traffic** - Use `pass` rules for known-good traffic to reduce processing load\n- **Regular Updates** - Run `suricata-update` daily via cron to keep signatures current\n- **Monitor Drops** - Track kernel packet drops and increase ring buffer size if needed\n\n## References\n\n- [Suricata Documentation](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002F)\n- [Suricata Rules Format](https:\u002F\u002Fdocs.suricata.io\u002Fen\u002Flatest\u002Frules\u002Findex.html)\n- [Emerging Threats Rulesets](https:\u002F\u002Frules.emergingthreats.net\u002F)\n- [OISF Suricata GitHub](https:\u002F\u002Fgithub.com\u002FOISF\u002Fsuricata)\n- [Suricata-Update Documentation](https:\u002F\u002Fsuricata-update.readthedocs.io\u002F)\n",{"name":5,"domain":21,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fnet-ids-suricataips","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill net-ids-suricataips",{"tool":40,"command":41},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill net-ids-suricataips",{"tool":43,"command":44},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill net-ids-suricataips","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-ids-suricataips\u002FSKILL.md",true,[48],{"path":49,"resourceType":50,"resourceTypeDesc":51,"sizeBytes":52,"sourceHtmlUrl":53},"index.json","REFERENCE","参考文档",461,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fnet-ids-suricataips\u002Findex.json",[55,80,103,125,147,163],{"skillNo":56,"name":57,"nameZh":6,"description":58,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":59,"categories":60,"keywords":61,"publishedAt":22},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,21,79],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":22},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[87,62,88,65,89,90,91,21,92,93,94,95,96,97,67,98,99,100,101,102],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":22},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[110,111,112,113,114,115,21,92,116,93,117,118,67,100,119,120,121,122,123,124],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":22},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[63,132,133,134,135,136,137,68,138,21,79,139,140,141,142,143,144,145,146,67],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":153,"publishedAt":22},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[154,155,63,156,134,136,157,68,158,138,21,79,93,159,160,161,162,146,67,69],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":22},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[170,63,134,171,157,68,172,173,21,79,174,175,176,177,178,179,67,69,180,181],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]