# Network scenarios for the Day-4 detection-engineering lab (Exercise B: Suricata).
# Each section is prefixed with "# Scenario N" — used as a delimiter.
# The LLM generates a single-line Suricata 7 rule for each scenario; the rule is
# validated OFFLINE with `suricata -T` (syntax self-test — never live capture).

# Scenario 1: Executable Download over Plain HTTP from a Raw-IP Host

Proxy logs show a workstation fetching a Windows executable over unencrypted HTTP
directly from a raw IP address (no hostname): GET /files/svchost_update.exe from
198.51.100.99. Legitimate software distribution in this environment always uses
HTTPS and named CDN hosts. Executable downloads over plain HTTP — especially from
raw-IP hosts — are a strong malware-delivery signal.

Detection goal: Alert on HTTP requests where the URI ends with ".exe".
Use the http.uri sticky buffer with an endswith match. Use sid 9000101 and rev 1,
classtype policy-violation.

# Scenario 2: Suspected C2 Beacon with a Scripted User-Agent

Netflow plus proxy data show a server making small, regular outbound HTTP requests
every 60 seconds to the same external host. Every request carries the User-Agent
"python-requests/2.31.0" — a scripting library UA that no approved application on
that server should produce. Regular-interval, fixed-UA outbound traffic is
consistent with command-and-control beaconing.

Detection goal: Alert on outbound HTTP requests whose User-Agent contains
"python-requests". Use the http.user_agent sticky buffer with a nocase content
match, direction $HOME_NET any -> $EXTERNAL_NET any. Use sid 9000102 and rev 1,
classtype trojan-activity.
