diff --git a/doc/userguide/rules/base64-keywords.rst b/doc/userguide/rules/base64-keywords.rst index 178fbe74d1..350fc236c0 100644 --- a/doc/userguide/rules/base64-keywords.rst +++ b/doc/userguide/rules/base64-keywords.rst @@ -47,5 +47,14 @@ Example:: http_uri = "GET /en/somestring&dGVzdAo=¬_base64" Rule: - alert http any any -> any any (msg:"Example"; content:"somestring"; base64_decode:bytes 8, offset 1, relative; \ - http_uri; base64_content; content:"test"; sid:10001; rev:1;) + alert http any any -> any any (msg:"Example"; http.uri; content:"somestring"; \ + base64_decode:bytes 8, offset 1, relative; \ + base64_data; content:"test"; sid:10001; rev:1;) + + Buffer content: + http_uri = "GET /en/somestring&dGVzdAo=¬_base64" + + Rule: + alert http any any -> any any (msg:"Example"; content:"somestring"; http_uri; \ + base64_decode:bytes 8, offset 1, relative; \ + base64_data; content:"test"; sid:10001; rev:1;)