Why ET rules used hex bytes instead of the original characters?

Rules
,
1

Hello everyone!

While studying the rules from Emerging Threats, I noticed one peculiarity. In the rules, instead of the original symbols (for example, “.”) their hexadecimal byte values are used.

Example Rules:

  1. alert http $HOME_NET any → $EXTERNAL_NET 1024: (msg:“ET DELETED Banker Infostealer/PRG POST on High Port”; flow:to_server,established; content:“POST”; nocase; http_method; content:“|2E|php|3F|2=”; nocase; content:“|26|n=”; nocase; content:“|26|v=”; nocase; content:“|26|i=”; nocase; content:“|26|sp=”; nocase; content:“|26|lcp=”; nocase; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; classtype:trojan-activity; sid:2008326; rev:8; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)
  2. alert http $EXTERNAL_NET any → $HOME_NET any (msg:“ET WEB_SERVER Possible Barracuda IM Firewall smtp_test.cgi Cross-Site Scripting Attempt”; flow:established,to_server; http.uri; content:“|2F|cgi|2D|mod|2F|smtp|5F|test|2E|cgi”; nocase; content:“email|3D|”; nocase; content:“hostname|3D|”; nocase; content:“default|5F|domain|3D|”; nocase; pcre:“/(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)/i”; reference:url, PSIRT.COM — Product Security Incident Response Team ; classtype:web-application-attack; sid:2010462; rev:6; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, updated_at 2020_09_14;)

Why can’t we write “.php?2” instead of “|2E|php|3F|2=” in rule number 1? In theory, Suricata should recognize the dot as a dot. Or in rule number 2, instead of “|2F|cgi|2D|mod|2F|smtp|5F|test|2E|cgi”, can we write “/cgi-mod/smtp_test.cgi”? The seconds variants look more readable for people who will be analyzing the rule detections.

The purpose of replacing symbols with hex bytes is to improve the performance of the Suricata engine, or are there other reasons?

2

Hi there,

There are a few characters that must be represented in hex in the rule language (cf https://community.emergingthreats.net). But ET teams and authors may also have their own conventions. I am not aware that using hex instead of available printable characters would offer a better performance.

If, as it seems, you want to know the decision process behind deciding to use hex bytes for content matching for certain ET rules, I expect that you’d get better answers for this asking directly at the ET forum.

3

Thanks a lot, for your answer.

Did I understand correctly that no matter which variant I use (using “.” or hex |2e|), it doesn’t affect the performance of the Suricata engine?

4

That is correct. During parsing it’s all converted to the same thing.