alert http any any -> $HOME_NET any (msg:"ET HUNTING PHP Serialize Object Injection M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; fast_pattern; http.header_names; content:"|0d 0a|Cookie|0d 0a|"; content:!"Referer|0d 0a|"; http.request_body; pcre:"/[a-z]\x3a\x2b?\d+\x3a(?:[a-z]?\x3a\d+\x3a?\x7b?|\x22[^\x22\x3b\x7b\x7d]*\x22|\x3b|\x7d)+/i"; classtype:web-application-attack; sid:2062296; rev:1; metadata:attack_target Web_Server, created_at 2025_05_13, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Major, updated_at 2025_05_13; target:dest_ip;)