Technology and tools
What is IDS?
Intrusion Detection System: a sensor that inspects network or host activity against rules and raises alerts on known attack patterns.
An intrusion detection system watches network traffic or host activity and raises an alert when it matches a known malicious pattern or looks anomalous. An intrusion prevention system, or IPS, sits inline and can also block the traffic.
Network IDS rules are written against packet contents and protocol behaviour, which makes them a natural place to turn threat intelligence about exploits and C2 traffic into detections.