Suricata

Hi all,

I've observed a pretty weird behaviour while investigating a rule miss against a pcap where this rule should normally hit.

If you run etpro-all.rules against the pcap you will have several alerts, but not on the rule with the sid 2841978 (ETPRO MALWARE Lemon_Duck Powershell Requesting Payload M2).

If you run a rule file that contains only this one rule with sid 2841978 it will fire as expected.

So I divided the problem down to rule 2009247 that is interfering with sid 2841978. If you run a rule file with both rules against the pcap 2841978 will not fire. If you run a rule file with only 2841978 in it, 2841978 will fire.

I've tested this behavior with Suricata 4.1.6, 5.0.2 and the newest 5.0.3.

In the attached zip archive you will find the yaml configurations and the logs for both runs. I couldn't compress the pcap to be smaller than 20MB. Please ping me when you're starting looking into this. I will share it with you via a file share system then.

Thanks,
Konstantin