Detection evasion and protocol anomalies: the defender’s side
In the lab you see how fragmentation, overlapping segments, TTL tricks and protocol anomalies fool sensors, and close those gaps with normalisation and anomaly detection.
Level 501 · 13 lessons · 12 practice labs
Lessons
How evasion works
- When the sensor and the target see differently: insertion and evasion
- Overlapping IP fragments and reassembly policies
- Overlapping TCP segments and stream reassembly differences
- TTL tricks: packets that reach the sensor but not the target
- Short task: show in a capture that one payload reassembles differently at sensor and target
Application level
- Escaping signatures with layers of URL and content encoding
- Protocol ambiguity: duplicate headers and non-standard ports
- Short task: explain why an encoded request slipped past a rule and fix the rule
Defence
- Normalisation: Suricata stream and defrag settings
- Choosing reassembly policy per target operating system
- Turning anomaly events into alerts: decoder and stream events
- Adding evasion samples to a continuous test set
- Capstone: test and harden a sensor against known evasion techniques
Practice labs
- Find overlapping fragments in a capture: Filter IP fragments with overlapping offsets in a prepared capture and write the overlapping byte range.
- One payload reassembled two ways: Show side by side the result overlapping TCP segments give under two different reassembly policies.
- Choose the reassembly policy fitting the target: Define a policy per target operating system in Suricata and prove the alert now fires on the prepared capture.
- TTL values changing within one session: Find the packets in one flow whose TTL differs markedly.
- The packet reaching the sensor but not the target: Compare captures taken at the sensor and at the target and list the packets seen only at the sensor.
- Turn anomaly events into alerts: Enable the decoder and stream event rules and report which anomalies are caught on the prepared capture.
- Unwrap the encoding layers: Decode a double URL-encoded request line step by step and write the actual path.
- Why the rule did not fire, and fix it: Explain why an encoded request slipped past a raw content rule and fix the rule with a normalised buffer.
- Duplicate headers and a non-standard port: Examine what the sensor sees in an HTTP capture with duplicate headers on a non-standard port and close the gap by enabling protocol detection.
- Review the stream and defrag settings: List the stream and defrag settings in suricata.yaml and mark those differing from defaults.
- Add the samples to the regression set: Add three prepared anomaly captures with expected alerts to the test set and run them with one command.
- Test and harden the sensor: Test your own lab sensor with prepared anomaly captures, close the misses through settings and write a before and after report.
About this course
In the lab you see how fragmentation, overlapping segments, TTL tricks and protocol anomalies fool sensors, and close those gaps with normalisation and anomaly detection.
What you will learn
- How evasion works
- Application level
- Defence
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.