alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET WEB_SPECIFIC_APPS Possible KLOG Server RCE Inbound (CVE-2020-35729)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"user=|22|"; startswith; content:"%22%26"; fast_pattern; reference:url,docs.unsafe-inline.com/0day/klog-server-unauthentication-command-injection; reference:cve,2020-35729; classtype:attempted-admin; sid:2031590; rev:1; metadata:attack_target Server, created_at 2021_01_29, cve CVE_2020_35729, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_01_29;)