Suricata

I don't think we can do this. Content keyword is all about literal matching and changing this would have an profound impact of a lot of code and logic (and likely performance).

You can of course express this already like this:

content:"watch me count|3a 20 00 01 02|"; content:"|04|"; distance:1; within:1;

We're planning to experiment with Hyperscan to optimize this into a regex and see how that will perform. That would be a hyperscan only optimization though, so for now I'm not willing to update the rule language for it. Rather it would happen behind the scenes.

Understood, depending upon the use case that is how we do it now. Thanks!