Suricata

It is possible to bypass/evade any tcp based signature by faking a closed TCP session using an evil server.
After the TCP SYN packet, it's possible to inject a RST ACK and a FIN ACK packet with an old TCP Timestamp option.
The client will ignore the RST ACK and the FIN ACK packets because of the old TCP Timestamp option.
Both linux and windows client are ignoring the injected packets.

Client    ->  [SYN] [Seq=0 Ack=0]                                     ->  Evil Server     # Legit TCP handshake
Client    <-  [RST, ACK] [Seq=0 Ack=1] [old TCP Timestamp option]     <-  Evil Server     # Injected packet
Client    <-  [FIN, ACK] [Seq=0 Ack=1] [old TCP Timestamp option]     <-  Evil Server     # Injected packet
Client    <-  [SYN, ACK] [Seq=0 Ack=1]                                <-  Evil Server     # Legit TCP handshake
Client    <-  [ACK] [Seq=1 Ack=1]                                     <-  Evil Server     # Legit TCP handshake
Client    ===============  Data evasion        =================          Evil Server

This evasion technique is referenced as CVE-2019-18625.

You can find attached :
- test.rule : A tcp rule that detects the string THIS_IS_A_TEST
- without_evasion.pcap : A web server which sends the string THIS_IS_A_TEST to a client without any evasion technique
- with_evasion_windows.pcap : A web server which sends the string THIS_IS_A_TEST to a windows 10 client with this evasion technique
- with_evasion_linux.pcap : A web server which sends the string THIS_IS_A_TEST to a linux client (kernel 5.2.0) with this evasion technique