alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible SQLi Attempt in User Agent (Outbound)"; flow:established,to_server; http.user_agent; content:"select"; nocase; fast_pattern; content:"from"; nocase; within:20; pcre:"/select[^\r\n]+from/i"; reference:url,blog.cloudflare.com/the-sleepy-user-agent/; classtype:misc-activity; sid:2022815; rev:5; metadata:created_at 2016_05_17, deployment Perimeter, deprecation_reason Age, performance_impact Moderate, confidence Low, signature_severity Minor, updated_at 2024_04_16, reviewed_at 2024_04_16; target:dest_ip;)