TryHackMe | Snort Challenge — The Basics

TryHackMe | Snort Challenge — The Basics — Walkthrough

Task 1: introduction

Read through the information and click Submit.

Task 2: Writing IDS Rules (HTTP)

Q1: Write rules to detect “all TCP port 80 traffic” packets in the given pcap file.

I created the following two rules inside of local.rules to identify any packets inbound or outbound.

alert tcp any any <> any 80 (msg: “found”; sid: 100001; rev:1;)
alert tcp any 80 <> …

basics challenge cybersecurity snort soc analyst tryhackme tryhackme-walkthrough