MAC771_354585
Nimbostratus
NimbostratusASM Regex rule
I am attempting to write a series of rules to target SQL injections, due to false positives that are occurring with the inbox rules.
I know that the re2 logic is sound, but I keep getting errors with what I believe is the F5 portion of the logic. What do I precede this statement with to make a valid rule?
re2:[a,A][n,N][d,D]\W\'[a-z,A-Z]\'=\'[a-z,A-Z]
valuecontent:"XXX";nocase;norm;re2:"[a,A][n,N][d,D]\W\'[a-z,A-Z]\'=\'[a-z,A-Z]"
is throwing errors stating there are unescaped characters.
