Custom Attack Signature to block request with No UA or Referer

Another way to say this is that you want the header to be mandatory. There is a setting under

Security ›› Application Security : Headers : HTTP Headers ›› Edit Header

Mandatory to Enabled will say the header must appear in the request