The following example shows use of a combined content, offset, and depth search rule.
alert tcp any any -> any 80 (content:"cgi-bin/phf"; offset:4; depth:20;)