Check for String in TCP Payload from a specific position

That's a novel idea Michael, but I think it would have an unintended consequence of passing some of the data through on the serverside before parsing the full request payload.

Here's a sample for using binary scan I tried in a quick test. Maybe something like this will work for you?

when RULE_INIT {
 Encode the raw bytes in base64 to test
set bytes_b64 "ABUXSF38AFBWnw8rCABFAAEqWx5AAIAGwrEKCAYS0OD7AydhEq69hQW7P+haN1AY+jbz+AAAAQAxNDEwMDAwMDAwMDAwMDE4ODg4ODgwMDU="
log local0. "\$bytes_b64: $bytes_b64"

set bytes_raw [b64decode $bytes_b64]
log local0. "\$bytes_raw: $bytes_raw"

 Skip 59 bytes into the payload and save the next 6 bytes to $match
binary scan $bytes_raw x59a6 match
log local0. "\$match: $match"
}

< RULE_INIT >: $match: 000000

I'll reply with a more specific example in a minute.

Aaron