Tune an Intrusion-Detection Rule Pack for Manufacturing PLCs
Overview
What this challenge is about.
Write Suricata rules to detect eight ICS attacks on PLC traffic, tune false positives under 2%, and earn a verifiable certificate.
The scenario
The vendor's PLC and HMI products sit on the production networks of European automotive plants, where a single nuisance alert that halts a line is as costly as a missed intrusion, so detections must be both complete and quiet. The product-security team distributes Suricata rule packs to customers because Suricata is free, runs inline as an intrusion-prevention sensor, and speaks the Modbus/TCP and Ethernet/IP protocols these PLCs use.
The Brief
What you'll do, and what you'll demonstrate.
Build a Suricata rule pack for four PLC families that detects all eight provided MITRE ATT&CK for ICS attack patterns while holding false positives under two percent on the captured baseline traffic.
Earning criteria — what you'll demonstrate
- Profile normal industrial protocol behavior (Modbus/TCP and Ethernet/IP) from packet captures to distinguish legitimate control traffic from attacks
- Translate MITRE ATT&CK for ICS techniques into precise, low-noise Suricata detection rules
- Measure and tune detection performance against a labeled baseline to drive false positives below a defined threshold
- Engineer a replayable, version-controlled detection test suite suitable for continuous integration
- Produce field-ready documentation that lets a non-author deploy an inline detection sensor safely on a live production network
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Intrusion Detection
Apply intrusion detection to solve real industry problems and demonstrate production-level capability.
- Ics Security
Apply ics security to solve real industry problems and demonstrate production-level capability.
- Suricata
Apply suricata to solve real industry problems and demonstrate production-level capability.
- Pcap Analysis
Apply pcap analysis to solve real industry problems and demonstrate production-level capability.
- Mitre Attack Ics
Apply mitre attack ics to solve real industry problems and demonstrate production-level capability.
- Modbus
Apply modbus to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
ICS / OT Detection Engineer
This challenge mirrors the core operational-technology security job: turning captured plant-floor traffic into reliable, low-noise detections. You leave able to baseline industrial protocols and ship rules that survive a real production network.
This challenge sharpens
- ics-security
- intrusion-detection
- pcap-analysis
Threat Detection Engineer
Detection engineers translate adversary techniques into tested, tuned rules. Mapping MITRE ATT&CK for ICS to Suricata signatures and proving a false-positive budget is exactly the day-to-day output of the role.
This challenge sharpens
- mitre-attack-ics
- suricata
- intrusion-detection
Product Security Engineer (Industrial)
Vendors must ship customers deployable security artifacts for their devices. Building a field-ready rule pack for specific PLC families bridges directly to securing an industrial product line and its customer fleet.
This challenge sharpens
- modbus
- ics-security
- suricata