alert ip any tny,,2226,8,, -> Any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directt:"/ajax/chat/send.php"; http_uri; content:".com"; http_header; reference:url,do; ,2226,8,, -> any !ny (msg:""GPLth directions"; flow:established; app-layer-event:applayer_mismatch_protocol_both_directt:"/ajax/chat/send.php"; http_uri; content:".com"; http_header; reference:url,do; content:"POST"; htcontent:"POST"; ht4;)
