Bad option value formatting (possible missing semicolon) for keyword content

Help
,
1

Please include the following information with your help request:

  • Suricata version

ver 7.0.6

  • Operating system and/or Linux distribution

FreeBSD 13.4

  • How you installed Suricata (from source, packages, something else)

packeges

Hello I have the following error after suricata-update

22/9/2024 -- 12:27:53 - <Error> -- bad option value formatting (possible missing semicolon) for keyword content: '!".mozilla.net'
22/9/2024 -- 12:27:53 - <Error> -- error parsing signature "alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Possible Windows Installer or Bitsadmin TLSv1.2 connection to FQDN - T1105"; flow:to_server, stateless; ja3.hash; content:"bd0bf25947d4a37404f0424edf4db9ad"; fast_pattern; tls_sni; content:!"microsoft.com"; endswith; nocase; content:!"live.com"; endswith; nocase; content:!"google.com"; endswith; nocase; content:!".ms"; endswith; nocase; content:!"libreoffice.org"; endswith; nocase; content:!"skype.com"; endswith; nocase; content:!"windows.net"; endswith; nocase; content:!"googleapis.com"; endswith; nocase; content:!"office.com"; endswith; nocase; content:!"azureedge.net"; endswith; nocase; content:!"sophosupd.com"; endswith; nocase; content:!"sophosxl.net"; endswith; nocase; content:!"sophos.com"; endswith; nocase; content:!"office.net"; endswith; nocase; content:!"jive.com"; endswith; nocase; content:!"adobe.com"; endswith; nocase; content:!"avast.com"; endswith; nocase; content:!"mozilla.org"; endswith; nocase; content:!".microsoft"; nocase; endswith; content:!".gvt1.com"; nocase; endswith; content:!".msedge.net"; nocase; endswith; content:!".msn.com"; nocase; endswith; content:!".microsoftonline.com"; nocase; endswith; content:!".windows.com"; nocase; endswith; content:!".bing.com"; nocase; endswith; content:!".mozilla.net; nocase; endswith; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/#download; reference:url,https://www.senseon.io/resource/resurgent-usb-malware-battling-raspberry-robin/; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2023_05_18, updated_at 2024_09_05; sid:3300209; rev:18; classtype:policy-violation;)" fro
22/9/2024 -- 12:27:53 - <Error> -- bad option value formatting (possible missing semicolon) for keyword content: '!".mozilla.net'
22/9/2024 -- 12:27:53 - <Error> -- error parsing signature "alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Possible Windows 11 Installer or Bitsadmin TLSv1.2 connection to FQDN - T1105"; flow:to_server, stateless; ja3.hash; content:"65005c9d9ae0f0ebeaf22c210571d482"; fast_pattern; tls_sni; content:!"microsoft.com"; endswith; nocase; content:!"live.com"; endswith; nocase; content:!"google.com"; endswith; nocase; content:!".ms"; endswith; nocase; content:!"libreoffice.org"; endswith; nocase; content:!"skype.com"; endswith; nocase; content:!"windows.net"; endswith; nocase; content:!"googleapis.com"; endswith; nocase; content:!"office.com"; endswith; nocase; content:!"azureedge.net"; endswith; nocase; content:!"sophosupd.com"; endswith; nocase; content:!"sophosxl.net"; endswith; nocase; content:!"sophos.com"; endswith; nocase; content:!"office.net"; endswith; nocase; content:!"jive.com"; endswith; nocase; content:!"adobe.com"; endswith; nocase; content:!"avast.com"; endswith; nocase; content:!"mozilla.org"; endswith; nocase; content:!".microsoft"; nocase; endswith; content:!".gvt1.com"; nocase; endswith; content:!".msedge.net"; nocase; endswith; content:!".msn.com"; nocase; endswith; content:!".microsoftonline.com"; nocase; endswith; content:!".windows.com"; nocase; endswith; content:!".bing.com"; nocase; endswith; content:!".mozilla.net; nocase; endswith; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/#download; reference:url,https://www.senseon.io/resource/resurgent-usb-malware-battling-raspberry-robin/; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2023_05_18, updated_at 2024_09_05; sid:3321316; rev:5; classtype:policy-violation;)" f

Yes, at the end of the last line there is an “f”.
My rules are in /var/lib/suricata/rules/suricata.rules
if I grep “mozilla.net” I don’t find any rule that cotain that domain. But If I grep “Possible Windows Installer or Bitsadmin TLSv1.2 connection to FQDN” I get the following rule that doesn’t cotain mozilla.net:

suricata.rules:21566:alert tls $HOME_NET any -> any any (msg:"🐾 - 🚨 Possible Windows Installer or Bitsadmin TLSv1.2 connection to FQDN - T1105"; flow:to_server, stateless; ja3.hash; content:"bd0bf25947d4a37404f0424edf4db9ad"; fast_pattern; tls_sni; content:!"microsoft.com"; endswith; nocase; content:!"live.com"; endswith; nocase; content:!"google.com"; endswith; nocase; content:!".ms"; endswith; nocase; content:!"libreoffice.org"; endswith; nocase; content:!"skype.com"; endswith; nocase; content:!"windows.net"; endswith; nocase; content:!"googleapis.com"; endswith; nocase; content:!"office.com"; endswith; nocase; content:!"azureedge.net"; endswith; nocase; content:!"sophosupd.com"; endswith; nocase; content:!"sophosxl.net"; endswith; nocase; content:!"sophos.com"; endswith; nocase; content:!"office.net"; endswith; nocase; content:!"jive.com"; endswith; nocase; content:!"adobe.com"; endswith; nocase; content:!"avast.com"; endswith; nocase; content:!"mozilla.org"; endswith; nocase; content:!".microsoft"; nocase; endswith; content:!".gvt1.com"; nocase; endswith; content:!".msedge.net"; nocase; endswith; content:!".msn.com"; nocase; endswith; content:!".microsoftonline.com"; nocase; endswith; content:!".windows.com"; nocase; endswith; content:!".bing.com"; nocase; endswith; reference:url,https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/#download; reference:url,https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/#download; reference:url,https://www.senseon.io/resource/resurgent-usb-malware-battling-raspberry-robin/; target:src_ip; metadata:attack_target Client_and_Server, signature_severity Major, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id TA0011, mitre_tactic_name Command_and_Control, mitre_technique_id T1105, mitre_technique_name Ingress_Tool_Transfer, created_at 2023_05_18, updated_at 2024_08_08; sid:3300209; rev:17; classtype:policy-violation;)

My question is:

  1. having the sid of the rule how can I trace the source? I asked to chatgtp and it says that there is file that map sid with source and the name is /var/lib/suricata/sid-msg.map but I didn’t find any file with that name.
  2. I ask this because if I understand correctly the source sends a rule that is malformed and the only thing I can do is disable that source. Is that right ?
  3. why there is an error about a domain that does not exist in the rules file ?

Thanks.

2

Each rule has content:!".mozilla.net; … there should be a double quote prior to the semicolon

3

I understood the error, but it does not depend on me as it is downloaded from the internet. Even if I correct it, I find it all again every time I update the sources. So my question is about how can I understand which source a certain rule belongs to.

4

Your process that fetches rules and installs them can make the change. Are you using suricata-update to curate (download, collect, install) your rules?

5

yes i use suricata-update to update rules as well as sources. i added sources to enrich the ruleset as i am looking for spyware or a covert channel.
For a while the sources i added were fine but now it seems some are acting up.

6

You’ll have to work in changes to the downloaded rules using suricata-update. That tool supports making changes to rules (enable, disable and modification)

7

These all look like Paw Patrules, would probably be good to also report them to the rule provider…

8

I have reached out to the maintainer of Paw Patrules, and at least 3300209 has been fixed. I’ll open an issue for the other one, as I think it ended up being missed.

GH repo: GitHub - woundride/pawpatrules