Suricata

Consider the following rule:

alert dns $HOME_NET any -> any any (msg:"ET INFO FUNNULL CDN Domain in DNS Lookup (* .funnull .com)"; dns.query; dotprefix; content:".funnull.com"; nocase; endswith; threshold: type limit, count 1, seconds 120, track by_src reference:url,www.silentpush.com/blog/triad-nexus-funnull/; reference:url,silentpush.com/blog/infrastructure-laundering/; classtype:bad-unknown; sid:2061962; rev:1; metadata:attack_target Client_and_Server, created_at 2025_04_29, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, updated_at 2025_04_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;)                                                                

Due to the missing semicolon, the threshold of "threshold: type limit, count 1, seconds 120, track by_src reference:url,www.silentpush.com/blog/triad-nexus-funnull/;" is getting parsed, including the entire next opt. In this case, it just means a missing reference. But it could alter the behaviour of a rule, depending on what the next opt is. The problem is in src/detect-threshold.c

There's a missing "$" at the end of this regex:

#define PARSE_REGEX                                                                                \                                                                                                                                                                                                                                                                                          
    "^\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE "\\s*,\\s*" PARSE_REGEX_NAME                 \                                                                                                                                                                                                                                                                                          
    "\\s+" PARSE_REGEX_VALUE "\\s*,\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE                 \                                                                                                                                                                                                                                                                                          
    "\\s*,\\s*" PARSE_REGEX_NAME "\\s+" PARSE_REGEX_VALUE "\\s*"