# Rule failed error

**URL:** <https://community.emergingthreats.net/t/rule-failed-error/2471>\
**Category:** Feedback & Support\
**Created:** [February 24, 2025, 6:56am UTC](https://community.emergingthreats.net/t/rule-failed-error/2471 "2025-02-24T06:56:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![EMTUser](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@EMTUser](https://community.emergingthreats.net/u/EMTUser)\
**Post date:** [February 24, 2025, 6:56am UTC](https://community.emergingthreats.net/t/rule-failed-error/2471/1 "2025-02-24T06:56:58Z")

</div>

Hi,  
Downloaded emerging rules from [Proofpoint Emerging Threats Rules](http://rules.emergingthreats.net/open/snort-2.9.0/)

The following rule is found in [http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-trojan.rules](http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-trojan.rules) updated on 2025\_02\_22 .

alert tcp $EXTERNAL\_NET 1337 → $HOME\_NET any (msg:“ET TROJAN implant.js CnC Activity (Evil Module Sent with DebugMode=ON)”; flow:established,to\_client; flowbits:isset,ET.implantjs.ack; content:“|81 01|”; depth:2; byte\_math:bytes 4, offset 0,oper +,rvalue 6,result length,relative; isdataat:!length; reference:url,[GitHub - captainGeech42/implant.js: Proof-of-concept modular implant platform leveraging v8](http://github.com/captainGeech42/implant.js); reference:url,[— DistrictCon](http://districtcon.org/bios-and-talks-2025/implantjs-modular-malware); classtype:trojan-activity; sid:2060259; rev:1; metadata:affected\_product Windows\_XP\_Vista\_7\_8\_10\_Server\_32\_64\_Bit, affected\_product Linux, attack\_target Client\_Endpoint, created\_at 2025\_02\_21, deployment Perimeter, performance\_impact Moderate, confidence High, signature\_severity Major, tag c2, updated\_at 2025\_02\_21, mitre\_tactic\_id TA0011, mitre\_tactic\_name Command\_And\_Control, mitre\_technique\_id T1071, mitre\_technique\_name Application\_Layer\_Protocol;)

and two or more rules has this byte\_math  
This rule generates error while running test in my Linux Desktop

command : snort -Tc snort.conf

ERROR: trojan.rules(42657) Unknown rule option: ‘byte\_math’.  
I verified the change logs and the following added rule cause error.

2053792 - ET TROJAN [ANY.RUN] NjRat (tXRAT v.2.3R) Client Sends Check-in Packet (emerging-trojan.rules)

Looking for suitable suggestion as to why this is throwing error in my system.  
Thanks,

---

<div class="post-metadata">

**Author:** ![bingohotdog](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/bingohotdog/32/42_2.png) [@bingohotdog](https://community.emergingthreats.net/u/bingohotdog)\
**Post date:** [February 24, 2025, 6:58pm UTC](https://community.emergingthreats.net/t/rule-failed-error/2471/2 "2025-02-24T18:58:29Z")

</div>

Hi @EMTUser,

Thank you for reporting this. The error details mention “Unknown rule option: ‘byte\_math’” which indicates the Snort Engine running does not have this keyword available. You may want to compare your Snort Engine version against our supported Snort engines here ([Announcing legacy Snort version support conditions](https://community.emergingthreats.net/t/announcing-legacy-snort-version-support-conditions/1812)). Any version older than snort-2.9.13 is not supported by our rule set.

The rule’s logic relies on the available Snort byte\_math keyword and so, the rule will remain as is until further notice. At this time, disabling the rule maybe the suitable next step.

Cheers,  
🌭