This rule constrains the search for the pattern "EFG" to the UNNORMALIZED URI.
alert tcp any any -> any 80 (content:"ABC"; content:"EFG"; http_raw_uri;)
|
Note:
The http_raw_uri modifier is not allowed to be used with the rawbytes, http_uri or fast_pattern modifiers for the same content.
|