snort

Overview

Snort is a network IDS/IPS with rule-based detection. Snort 3 uses modular inspector architecture; rules from Talos/community.

Deploy inline or passive tap. Signature + preprocessor anomaly detection.

Primary use cases

• Lab IDS tuning and signature development
• Detecting exploit attempts and malware C2 patterns

Detection / defense notes

• Keep rules updated; tune false positives per environment

Related tools

• Wireshark — Packet dissector. Live capture and PCAP analysis with display filters and protocol decoders.
• YARA — Malware identification language. String/hex patterns with boolean conditions over scanned files.
• Nmap — Network mapper. SYN/UDP scanning, service detection, NSE scripts, and OS fingerprinting. The baseline recon tool.