evo-suricata-custom-exfil

evo-suricata-custom-exfil

Description

Generates Suricata 7.0 rules for detecting data exfiltration hidden in HTTP telemetry traffic. Handles all five detection conditions with proper sticky buffer syntax, URL-decode transforms, parameter boundary awareness, and PCRE anchoring to minimize false positives and false negatives.

Domain Knowledge

Suricata 7.0 Rule Structure

• Header: alert http any any -> any any — use alert http to leverage Application Layer Protocol Identification (ALPI); avoids port-dependent matching.
• Use any any -> any any when both source and destination may be internal (e.g., 10.x to 10.x).
• Options in parentheses, semicolon-delimited.
• Must include sid, rev, and ideally flow:established,to_server.

Sticky Buffers (Suricata 7.0)

Sticky buffers are context switches: once declared, all subsequent content, pcre, bsize, depth, offset, distance, within keywords apply to that buffer until a new sticky buffer is declared. This is the modern 7.0 approach — legacy trailing modifiers like http_method are deprecated.

• http.method; — matches HTTP verb (POST, GET, etc.)
• http.uri; — normalized URI including query string and leading /
• http.uri.raw; — unnormalized URI as on the wire
• http.header; — all request headers concatenated, CRLF-separated
• http.request_header; — individual header, name and value joined by |3a 20| (: )
• http.request_body; — HTTP request body (POST/PUT/PATCH payload)

Critical Rules & Edge Cases

1. Sticky buffer ordering: Buffer keyword BEFORE content match. Correct: http.method; content:"POST"; Wrong: content:"POST"; http.method;

2. Exact URI matching: http.uri includes query string. Use startswith; endswith; to prevent substring matches (e.g., /telemetry/v2/report/extra).

3. Header matching options:

   • http.header; with content:"X-TLM-Mode"; content:"exfil"; — works but risks cross-header false positives.
   • http.request_header; with content:"X-TLM-Mode|3a 20|exfil"; — isolates a single header, more precise. The |3a 20| is the colon-space separator Suricata normalizes.