In reply to Marc Jonkers.

Hi Marc,
Note that the 4187/3 detects a high rate of heartbeat requests from a client to a server (6 in 2sec). So, 4187/3 is time-based. You can go low and slow under it, but are unlikely to get useful information. High rate of malicious messages are more likely to get useful information for the attacker and are the type of attack 4187/3 is designed for. Briefly looking at the exploit code, I don't think it sends the requests in the expected frequency and that is why you don't see hits.

The 4187/4 detects a larger than expected amount of heartbeat data being returned. Detection depends on the response size. I am double checking something in the size matching expression right now and if we need to tune it more we will do that.

Going back and looking at the regex in 4187/0 (and thus 4187/2 if 200 bytes of data are also seen coming back) should be matching the exploit request. The regex in the sig is ^\x18\x03[\x00-x03]. That should match what is sent by the exploit code which is

hb = h2bin('''
18 03 02 00 03
01 40 00
''')

So, I would suggest to test that 4187/1 by itself. It should fire with the exploit code. Then I would suggest to lower the trigger rate of 4187/3 to see if it matches. For the 4187/4 I will check the regex internally.

I believe the sigs should work now. I am sorry that I can't troubleshoot this further over the Blog. If there are still issues, please open a case with Cisco TAC and we should be able to look into it a little further, get packet captures and get to the bottom of it.

Panos