alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-MISC Apache P Filter xss attempt"; flow:to_server,established; content:"GET "; uricontent:"?P="; uricontent:"<"; pcre:"/\/.*\?P\=(.){0,20}\</Um"; pcre:"/^GET /m"; reference:cve,2007-4465; classtype:web-application-attack; sid:92256; rev:1;)