All three VMs run on VirtualBox, NAT-networked on 192.168.0.0/24.

Why Suricata runs on the attacker box

Suricata needs visibility into traffic between the attacker and the target. Two options exist: a dedicated sensor VM with a promiscuous/mirrored interface, or running the sensor on one of the two hosts already in the traffic path. Since the Wazuh manager (Amazon Linux 2023) doesn't have EPEL support and made installing Suricata impractical, and the target can't run any agent at all, Suricata runs directly on the Kali box. This means it sees 100% of the attack traffic on its own interface with no promiscuous mode or span port required, and ships its events to the manager through the Wazuh agent already enrolled on Kali.

Detections

1. Reconnaissance — Nmap Scan Detection

Attack:

Detection: Suricata's Emerging Threats ruleset flagged multiple scan-related and protocol-anomaly signatures in real time as the scan touched each open port, including traffic on Metasploitable's exposed UnrealIRCd service (ET CHAT IRC USER command).

Result: 132+ IDS events generated and correctly classified under the ids, suricata rule groups in Wazuh's Threat Hunting view within seconds of the scan completing.

2. Exploitation — vsftpd 2.3.4 Backdoor (CVE-2011-2523)

Attack:

Metasploitable's vsftpd 2.3.4 contains a backdoor triggered by a malformed FTP login string, which spawns a root shell on TCP port 6200. The exploit landed cleanly and returned a Meterpreter session as root.

Detection: Suricata's GPL ATTACK_RESPONSE id check returned root signature (SID 2100498) fired 11 seconds after the shell was spawned, matching the plaintext uid=0(root) string in the shell's command output as it crossed the wire on port 6200.

Why this matters: this is network-layer confirmation of a successful root compromise on an asset with zero host-based logging the exact scenario the architecture was designed to handle.

3. Credential Attack — FTP Brute Force (MITRE ATT&CK T1110)

Attack:

Hydra attempted multiple FTP logins in rapid succession, correctly identifying the valid credential pair msfadmin:msfadmin after several failed attempts.

Detection status: Suricata's FTP protocol parser captured every individual USER/PASS command and server response code in eve.json (event_type: ftp), confirmed present in the manager's raw event archive:

Suricata's default ruleset has no dedicated signature for FTP brute-forcing, since it's a protocol pattern rather than a known-bad string. A custom Wazuh correlation rule was engineered to close this gap:

Status: in progress — the underlying event data is confirmed reaching the manager, and rule syntax is validated via wazuh-logtest, but the correlation rule (100101) is not yet reliably firing end-to-end. Next debugging step is confirming the decoder field path assigned to nested Suricata FTP fields at parse time via wazuh-logtest against a live sample. Tracked as future work below.

Lessons Learned

• Legacy targets change your architecture, not just your commands. Metasploitable 2's outdated toolchain ruled out a modern Wazuh agent and even basic syslog forwarding (no rsyslog, no internet access). Rather than force a host-based approach, the project pivoted to network-based detection — arguably a more realistic pattern for real-world legacy/IoT assets.
• Package ecosystems aren't interchangeable. The Wazuh manager's Amazon Linux 2023 base doesn't support classic EPEL, which blocked a direct Suricata install there. Moving the sensor to the Debian-based Kali box, which already sat in the traffic path, sidestepped the problem entirely.
• Default IDS rulesets are signature-based, not behavioral. Suricata caught the vsftpd exploit instantly because a known signature existed for it, but had nothing for FTP brute-forcing because that's a pattern, not a static string. This is the real justification for writing custom correlation rules in a SIEM rather than relying on out-of-the-box IDS content alone.
• archives.log/archives.json are not enabled by default (logall/logall_json are no out of the box) and are essential for debugging what a SIEM actually received versus what it chose to alert on.

Future Work

• Finish debugging the FTP brute-force correlation rule (100100/100101) end-to-end
• Add UnrealIRCd backdoor exploitation (CVE-2010-2075) as a fourth detection, since Suricata is already flagging IRC traffic on the target
• Add Samba usermap_script RCE (CVE-2007-2447) for a fifth technique
• Wire high-severity alerts into TheHive or Shuffle for automated case creation
• Add active-response to automatically block the attacker IP on repeated brute-force detections

Tools Used

• Wazuh 4.14.6 — SIEM (manager, indexer, dashboard)
• Suricata 8.0.5 — Network IDS
• Metasploit Framework / Hydra / Nmap — attack simulation
• VirtualBox — lab virtualization

MITRE ATT&CK Mapping