evo-suricata-http-exfil

Suricata HTTP Exfiltration Detection Rule Skill

This skill provides reusable functions for generating Suricata rules that detect HTTP-based data exfiltration. It handles:

• Building rules with HTTP sticky buffers (http.method, http.uri, http.header, http.request_body)
• Exact URI matching with bsize
• Header name:value matching with CRLF boundary and optional case-insensitivity
• Body field matching with URL-encoded field boundary checks to prevent substring false positives
• Syntax validation via suricata -T
• Functional validation against positive/negative pcap files

Key Technical Details

HTTP Sticky Buffers

• http.method - matches the HTTP method (GET, POST, etc.)
• http.uri - matches the normalized URI path; use bsize:N for exact length
• http.header - matches raw request headers
• http.request_body - matches the HTTP request body

Header Matching Best Practices

• HTTP header names are case-insensitive per RFC 7230; use nocase to handle variations
• Append |0d 0a| (CRLF) after the header value to prevent substring false positives (e.g., header value "exfil" should not match "exfiltrate")
• The http.header buffer contains raw headers as sent by the client

Body Field Boundary Matching

In URL-encoded bodies (application/x-www-form-urlencoded), fields are separated by & and the first field starts at the beginning of the body. A naive content:"blob=" would match xblob= as a substring.

The correct approach uses PCRE with field boundary checks:

pcre:"/(?:^|&)fieldname=VALUE_PATTERN/"

This ensures fieldname is either at the start of the body or preceded by &.

PCRE with /R Flag

• /R means "relative to last content match"
• When not using a preceding content anchor, omit /R to search the entire buffer
• Use (?:^|&) for URL-encoded field boundary matching

Common Pitfalls

• bsize must exactly equal the URI string length (count carefully)
• Content matches are substring matches; use field boundaries to prevent false positives
• Header names in http.header buffer are raw (not normalized for case)
• flow:to_server,established ensures we match client requests in established TCP sessions
• All conditions within a single rule are conjunctive (AND)