Multiple modifications to a rule do not work
Given 2 or more entries in the modify.conf file that would apply to the same rule, only the last one affects the output. For example, given a modify.conf of
re:"GPL\ WORM" "alert(.*)" "drop\1" re:"GPL\ WORM" 1434 5555
only the last line will take affect, and the rule will be left in the "alert" state.