Snort IDS Setup & Custom Rules for Malware Detection (Remcos RAT Case Study)

Load and Analyze pcap File

• Open the given RemcosRAT.pcap file in Wireshark.
• Identify communication patterns between infected host and C2 server.
• Note important protocols, ports, and payloads.

Identify Remcos RAT Network Signature

Identify Remcos RAT Network Signature

From the packet capture, identify the unique signature that differentiates Remcos RAT traffic. Possible indicators include:

• Unique byte patterns / magic bytes in packets
• Fixed ports or services used
• Unusual payload structures

📌 Step 1: Install Dependencies and Snort

sudo apt update  
sudo apt install snort -y

During installation, you may be asked for:

• Snort network interface → use your active interface (e.g., ens33, eth0, or wlan0).
• Address range → set your local network range (e.g., 192.168.1.0/24).

📌 Step 2: Check Snort Rule Paths

• Open the Snort configuration file:

sudo nano /etc/snort/snort.conf

• Make sure these paths are correct:

var RULE_PATH /etc/snort/rules  
var SO_RULE_PATH /etc/snort/so_rules  
var PREPROC_RULE_PATH /etc/snort/preproc_rules

• Verify with:

grep 'RULE_PATH ' /etc/snort/snort.conf

📌 Step 3: Update Snort Logging Output

• Modify unified2 output with a sed one-liner:

sudo sed -i "/^output unified2/coutput unified2: filename snort.u2, limit 128" /etc/snort/snort.conf

• Check it:

grep '^output unified2' /etc/snort/snort.conf

📌 Step 4: Enable Local Rules

• Uncomment this line in /etc/snort/snort.conf:

#include $RULE_PATH/local.rules

• Change it to:

include $RULE_PATH/local.rules

Or run:

sudo sed -i 's/#include \$RULE_PATH\/local.rules/include \$RULE_PATH\/local.rules/' /etc/snort/snort.conf

📌 Step 5: Prepare Snort Directories

sudo mkdir /var/log/snort/archived_logs  
sudo mkdir /etc/snort/preproc_rules  
sudo mkdir /etc/snort/so_rules

• Set correct permissions:

sudo chown -R snort:snort /etc/snort  
sudo chown -R snort:snort /var/log/snort  
sudo chown -R snort:snort /usr/lib/snort/snort_dynamicrules

Verify:

ls -lad /var/log/snort/archived_logs/

📌 Step 6: Add Custom Rules

• Open the local rules file:

sudo nano /etc/snort/rules/local.rules

Example Rule 1 — Detect Remcos RAT Magic Bytes

alert tcp any any -> any any (msg:"Remcos RAT Magic Bytes Detected"; content:"|24 04 FF 00|"; sid:1000001; rev:1;)

Example Rule 2 — Add Refinement (Check Payload Length > 100)

alert tcp any any -> any any (msg:"Remcos RAT Large Payload"; content:"|24 04 FF 00|"; dsize:>100; sid:1000002; rev:1;)

Save and exit.

📌 Step 7: Verify Snort Configuration

Run:

sudo snort -T -c /etc/snort/snort.conf -i ens33

• If you see: Snort successfully validated the configuration! → You’re good ✅
• If errors appear, fix the specified line and retry.

📌 Step 8: Run Snort in NIDS Mode

sudo snort -A console -q -c /etc/snort/snort.conf -i ens33

• -A console → Show alerts in terminal
• -q → Quiet mode (suppress banner)
• -c → Config file
• -i → Interface

📌 Step 9: Checking Logs

Logs are stored in:

/var/log/snort/

Archived logs in:

/var/log/snort/archived_logs/  

• Run Snort with PCAP file (RemcosRAT traffic):

sudo snort -A console -q -c /etc/snort/snort.conf -r RemcosRat.pcap

Observe alerts in console:

03/10-17:48:04.414960  [**] [1:1000002:1] Remcos RAT Large Payload [**] [Priority: 0] {TCP} 10.3.10.101:50507 -> 206.123.152.51:3980
03/10-17:48:05.427805  [**] [1:1000002:1] Remcos RAT Large Payload [**] [Priority: 0] {TCP} 10.3.10.101:50507 -> 206.123.152.51:3980
03/10-17:48:05.563996  [**] [1:1000002:1] Remcos RAT Large Payload [**] [Priority: 0] {TCP} 206.123.152.51:3980 -> 10.3.10.101:50508
...

✍️ Author: Hardik Patel

🔗 Feel free to connect with me on LinkedIn.

Thank You.