Snort Rule : detect request abc.jsp and cookie value = null - pcap

Question

I would like to detect and send alert with snort for:
request /abc/abc.jsp and
cookie abc value is null
I tried:
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORT (sid:xxx; gid:1; content:"/abc/abc.php"; http_uri; pcre:"abc=''"; msg:"BLACKLIST - request without cookie ";)
but it does not seem to work...

Answer 1

Your pcre content is not following the correct syntax. You need to put the content between forward slashes (/). See the manual here. So your pcre option should look like the following:
pcre:"/abc=''/"
I would also note that this pcre probably isn't sufficient for what you want to do. I would do something like the following:
pcre:"/abc=('|\")(\1)/C"
This will allow you to look for both single and double quotes so this would match either of the following:
abc=''
abc=""
Also adding the C at the end of the pcre will tell snort to only check the following:
Match normalized HTTP request or HTTP response cookie
Which is more efficient and less prone to false positive since it's only checking the normalized cookie content.
It's also less prone to false negatives because it's checking the normalized content of the cookie because if the cookie is for some reason URL encoded ' would be %27 and " would be %22 and the pcre won't match. Giving the C option snort will check the normalized payload and would match.
So your final rule might look like:
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORT (sid:xxx; gid:1; content:"/abc/abc.php"; http_uri; pcre:"/abc=('|\")(\1)/C"; msg:"BLACKLIST - request without cookie ";)

Answer 2

Cookie structure: name=value;
If u want to detect cookie abc value is null, use pattern abc=;
alert tcp any any -> any any (msg:"test-cookie"; content:"abc=\;"; http_cookie; nocase;)