RESOLVED: Snort and Suricata Service Startup Failures on ET rules update
-
Issue Summary:
Following the automated nightly rule update, the Snort service on the WAN interface crashed and failed to start. The issue was caused by two separate syntax errors introduced upstream in last night's Emerging Threats (ET) rule package release.Technical Details & Root Causes:
- Rule SID 2054074 (ET EXPLOIT Kingdee Cloud Star Deserialization): The rule authors introduced a logical paradox in the destination target field ([$EXTERNAL_NET,$HTTP_SERVERS]). Because our firewall defines $EXTERNAL_NET as a negation (!$HOME_NET), Snort encountered an unresolvable routing loop and threw a fatal compilation error.
- Rule SID 2033776 (ET TROJAN NSO Group Pegasus Related Data Exfil): This rule contained a malformed regular expression (PCRE parsing conflict) that broke the trailing option block, causing Snort to drop the rule's closing parenthesis and crash on line 10111.
Resolution Action Taken:
The interface configuration was safely isolated and paused.
SID 2054074 Fix: Manually corrected the broken variable logic by swapping the conflicting $EXTERNAL_NET reference to $HOME_NET, allowing the engine to mathematically resolve the network paths cleanly.
SID 2033776 Fix: Cleaned up the broken trailing regular expression string parameters to satisfy the parser.
The rules file was updated, and the interface was toggled back on.
Current Status: The Snort engine has successfully verified the configurations, compiled the rule chains, and is now fully active and running on the WAN interface. No further action is required unless a subsequent rule update overwrites these manual patches before the vendor pushes official fixes.
-
J JonathanLee referenced this topic on
-
@JonathanLee after every snort update problem appears again
-
@mspant It will probably take about 48 hours for ET to fix those bad rules. They have to report it, fix it, and deploy it. Since it is the weekend, my guess is it won't be ready until Tuesday. For now, you might want to just disable those two rules or fix the updates by hand.
-
Had another rule error using IPS Policy Max-Detect: FATAL ERROR: /usr/local/etc/snort/snort_58840_igb0/rules/snort.rules(76593) Unknown rule option: 'modbus_func'.
Well, hello there...
-
@4BDN_1 said in RESOLVED: Snort and Suricata Service Startup Failures on ET rules update:
Had another rule error using IPS Policy Max-Detect: FATAL ERROR: /usr/local/etc/snort/snort_58840_igb0/rules/snort.rules(76593) Unknown rule option: 'modbus_func'.
With no intention to "teach" - as far as I remember Bill Meeks (the Ex-Maintainer of Snort & Suricata) stated that Max-Detect should not be used in productivity environment because its prone to many faults/false-positives! (IMHO)
-
@JonathanLee This is actually a perfect solution for the current issue with these particular rules. It really made correcting this issue quite easy until they come up with a patched set of rules.
Change made on my end for the secondary problem.Rule SID 2033776 (ET TROJAN NSO Group Pegasus Related Data Exfil): This rule contained a malformed regular expression (PCRE parsing conflict) that broke the trailing option block, causing Snort to drop the rule's closing parenthesis and crash.
SID 2033776 Fix: Removing the broken additional trailing regular expression sting parameter
[\r\n]+Original rule line
pcre:"/^Content-Type\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r\nContent-Length\x3a\x20[^\r\n]+\r\nExpect\x3a\x20[^\r\n]+[\r\n]+$/H"Corrected rule line
pcre:"/^Content-Type\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r\nContent-Length\x3a\x20[^\r\n]+\r\nExpect\x3a\x20[^\r\n]+$/H"Thank you.
-
@Xquizet yes
Disable the bad ones with rule id 2054074, and 2033776 and after
add the fixed versions of them to your custom area in your IPS like this.
alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT Kingdee Cloud Star Deserialization Vulnerability"; flow:established,to_server; content:"POST"; http_method; content:"Kingdee"; http_uri; content:".UserService."; http_uri; distance:0; content:"Content-Type|3a 20|text/json|0d 0a|"; http_header; content:"|22|ap0|22 3a 22|"; http_client_body; fast_pattern; content:"|0d 0a|cmd|0d 0a|"; http_header; reference:url,gksec.com/K3cloud_rce.html; classtype:trojan-activity; sid:2054074; rev:2; metadata:affected_product Kingdee_Cloud, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_06_26, deployment Perimeter, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_06_05;) alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN NSO Group Pegasus Related Data Exfil (POST)"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; pcre:"/\.php$/U"; content:"g="; depth:2; fast_pattern; http_client_body; pcre:"/^Content-Type\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r\nContent-Length\x3a\x20[^\r\n]+\r\nExpect\x3a\x20[^\r\n]+$/H"; reference:url,www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html; reference:md5,0a1c6d9cd67172995d22fa54946662f0; classtype:trojan-activity; sid:2033776; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_08_24, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_08_24;)just disable the rules create good ones and add them to custom area if you need them
Custom area for snort is here..
-
@4BDN_1 said in RESOLVED: Snort and Suricata Service Startup Failures on ET rules update:
Had another rule error using IPS Policy Max-Detect: FATAL ERROR: /usr/local/etc/snort/snort_58840_igb0/rules/snort.rules(76593) Unknown rule option: 'modbus_func'.
You likely do not have the MODBUS preprocessor enabled, hence the "unknown rule option" error. Modbus is an industrial controls protocol that has no function in a typical home or business network environment. It is pointless to run those rules in such networks.
