Please include the following information with your help request:
- Suricata version : 8.0.0
- Operating system and/or Linux distribution : WSL2.0 , ubuntu 22.04
- How you installed Suricata : from source
I have recently been testing a Network Intrusion Detection System (NIDS) and have used both Snort3 and Suricata to test the same HTTP network traffic. These packets were generated based on the official Snort rule set. However, after testing, I found that the same packet can trigger an alert in Snort3, but not in Suricata.
For example, the following rule exists in the official Snort2 rule set (snort2-browser-plugins.rules):
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BROWSER-PLUGINS Microsoft Windows Image Acquisition Logger ActiveX clsid access"; flow:to_client,established; file_data; content:"A1E75357-881A-419E-83E2-BB16DB197C68"; fast_pattern:only; pcre:"/(<object\s*[^>]\sid\s*=\s*(?P<m1>\x22|\x27|)(?P<id1>.+?)(?P=m1)(\s|>)[^>]\sclassid\s*=\s*(?P<q1>\x22|\x27|)\sclsid\s\x3a\s*{?\sA1E75357-881A-419E-83E2-BB16DB197C68\s}?\s*(?P=q1)(\s|>).(?P=id1)\s.\s*(Save)|<object\s*[^>]\sclassid\s*=\s*(?P<q2>\x22|\x27|)\sclsid\s\x3a\s*{?\sA1E75357-881A-419E-83E2-BB16DB197C68\s}?\s*(?P=q2)(\s|>)[^>]\sid\s*=\s*(?P<m2>\x22|\x27|)(?P<id2>.+?)(?P=m2)(\s|>).(?P=id2).(Save))\s(/Osi"; metadata:policy max-detect-ips drop, service http; reference:bugtraq,31069; reference:cve,2008-3957; classtype:attempted-user; sid:14266; rev:12;)
And the Snort3 version of the same rule is:
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any ( msg:"BROWSER-PLUGINS Microsoft Windows Image Acquisition Logger ActiveX clsid access"; flow:to_client,established; file_data; content:"A1E75357-881A-419E-83E2-BB16DB197C68",fast_pattern,nocase; pcre:"/(<object\s*[^>]\sid\s*=\s*(?P<m1>\x22|\x27|)(?P<id1>.+?)(?P=m1)(\s|>)[^>]\sclassid\s*=\s*(?P<q1>\x22|\x27|)\sclsid\s\x3a\s*{?\sA1E75357-881A-419E-83E2-BB16DB197C68\s}?\s*(?P=q1)(\s|>).(?P=id1)\s.\s*(Save)|<object\s*[^>]\sclassid\s*=\s*(?P<q2>\x22|\x27|)\sclsid\s\x3a\s*{?\sA1E75357-881A-419E-83E2-BB16DB197C68\s}?\s*(?P=q2)(\s|>)[^>]\sid\s*=\s*(?P<m2>\x22|\x27|)(?P<id2>.+?)(?P=m2)(\s|>).(?P=id2).(Save))\s(/Ois"; metadata:policy max-detect-ips drop; service:http; reference:bugtraq,31069; reference:cve,2008-3957; classtype:attempted-user; sid:14266; rev:12; )
The HTTP packet that should trigger these two alerts is:
GET /connecttest.txt HTTP/1.1
Connection: Close
User-Agent: Microsoft NCSI
Host: www.msftconnecttest.com
Content-Type: text
Content-Length: 227
<object
bPREYRU^2
id= fn+6e)*NE_B
classid =
clsid:
A1E75357-881A-419E-83E2-BB16DB197C68
}
<T;HBS:1FgQdW'C_fn+6e)*NE_B . \x53\x61\x76\x65
When using this HTTP packet for testing, I found that Snort3 can trigger the alert normally, but Snort2 cannot. Snort2 is using the default configuration.
I would like to ask if this is due to a problem with my environment setup, or if there are other reasons for this situations?
I appreciate you taking the time reading this topic . Please let me know if you have any insights or suggestions regarding the issue I’m facing with the Snort2 rule not being triggered. I sincerely appreciate any comments and I’m willing to provide more detailed informations if you need.