Suricata

It seems that standard (i.e. ASCII char 22) quotation marks were replaced by fancy quotes in the Payload Keywords, and possibly other, documentation.

https://suricata.readthedocs.io/en/latest/rules/payload-keywords.html#content

With some sections using completely different sets...

Fancy-quotes matched appropriately:

content:“a|0D|bc”;

Fancy-quote mixed with standard quote:

content:”|61 0D 62 63|";

Mismatched fancy quotes:

content:”a|0D|b|63|”;

Is that intentional (i.e. intended to show an indifference for quote types)? If so, that should probably be explicit stated instead.

Even if there is an indifference for quote types, the escaping described will be problematic...

“     |22|

...since it will convert a fancy quote into a standard one, which is likely inappropriate.