Tune an Intrusion-Detection Rule Pack for Manufacturing PLCs
Overview
What this challenge is about.
Tune an Intrusion-Detection Rule Pack for Manufacturing PLCs. Expert-level challenge in code. Writing production code that solves real engineering problems, ...
The Brief
What you'll do, and what you'll demonstrate.
Build a Suricata rule pack for four PLC families that detects all eight provided MITRE ATT&CK for ICS attack patterns while holding false positives under two percent on the captured baseline traffic.
This is not a coding exercise. It is the work a software engineer does between a Jira ticket and a merged PR. That distinction matters to every hiring manager who has seen candidates solve LeetCode problems and none who have shipped production code under real constraints.
When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."
Earning criteria — what you'll demonstrate
- Profile normal industrial protocol behavior (Modbus/TCP and Ethernet/IP) from packet captures to distinguish legitimate control traffic from attacks
- Translate MITRE ATT&CK for ICS techniques into precise, low-noise Suricata detection rules
- Measure and tune detection performance against a labeled baseline to drive false positives below a defined threshold
- Engineer a replayable, version-controlled detection test suite suitable for continuous integration
- Produce field-ready documentation that lets a non-author deploy an inline detection sensor safely on a live production network
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Intrusion Detection
Apply intrusion detection to solve real industry problems and demonstrate production-level capability.
- Ics Security
Apply ics security to solve real industry problems and demonstrate production-level capability.
- Suricata
Apply suricata to solve real industry problems and demonstrate production-level capability.
- Pcap Analysis
Apply pcap analysis to solve real industry problems and demonstrate production-level capability.
- Mitre Attack Ics
Apply mitre attack ics to solve real industry problems and demonstrate production-level capability.
- Modbus
Apply modbus to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
ICS / OT Detection Engineer
This challenge mirrors the core operational-technology security job: turning captured plant-floor traffic into reliable, low-noise detections. You leave able to baseline industrial protocols and ship rules that survive a real production network.
This challenge sharpens
- ics-security
- intrusion-detection
- pcap-analysis
Threat Detection Engineer
Detection engineers translate adversary techniques into tested, tuned rules. Mapping MITRE ATT&CK for ICS to Suricata signatures and proving a false-positive budget is exactly the day-to-day output of the role.
This challenge sharpens
- mitre-attack-ics
- suricata
- intrusion-detection
Product Security Engineer (Industrial)
Vendors must ship customers deployable security artifacts for their devices. Building a field-ready rule pack for specific PLC families bridges directly to securing an industrial product line and its customer fleet.
This challenge sharpens
- modbus
- ics-security
- suricata