Suricata

Given the below example rule where we are looking for a HTTP POST with a http_cookie negation:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"COOKIE Y"; flow:to_server,established; content:"POST"; http_method; content:!"this_doesnt_exist_who_cares_it_should_still_fire"; http_cookie; classtype:trojan-activity; sid:102; rev:1;)

This will fire on this traffic which has a cookie in it...

POST /trach/00/00/980014/index/xb/OF.php HTTP/1.1
Accept-Encoding: identity
Content-Length: 59
Host: vitospetromata.gr
Connection: close
Referer: http://vitospetromata.gr/trach/00/00/980014/index/xb/OF.php
Cookie: _mcnc=1
Content-Type: application/x-www-form-urlencoded

...but will not fire on this traffic that does not have a cookie in it.

POST /index2.php HTTP/1.1
Accept-Encoding: identity
Content-Length: 143
Host: moifesgeucswaytvvxe.altervista.org
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:42.0) Gecko/20100101 Firefox/42.0
Connection: close
Referer: http://moifesgeucswaytvvxe.altervista.org/Update.html
Content-Type: application/x-www-form-urlencoded

It seems like this negation should work in both cases? Tested in 4.0.4, 4.0.1, and latest git.