Suricata

I think this could be implemented as a transform indeed, e.g. something like:

file.data; luaxform:somescript.lua; content:"abc"; pcre:"/xyz/R";