An analyst is building a Suricata detection rule for a known exploit that sends a specific 8-byte magic value at offset 0 in a TCP payload on port 9001. Which rule syntax correctly captures this?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because it specifies TCP protocol, destination port 9001, the exact hex content with offset:0 and depth:8 constraining the match to the first 8 bytes of the payload, which is the precise requirement. B is wrong because UDP is the wrong protocol.
Full explanation below image
Full Explanation
A is correct because it specifies TCP protocol, destination port 9001, the exact hex content with offset:0 and depth:8 constraining the match to the first 8 bytes of the payload, which is the precise requirement. B is wrong because UDP is the wrong protocol. C is wrong because a NOP sled PCRE is unrelated to the described magic bytes pattern. D is wrong because matching on IP with dsize:8 only checks packet size, not payload content, and would match any 8-byte IP packet.