Hello, there's a typo in sid 2008359: content:"|0d 0a|User-Agent: NSI SDL/1.2 (Mozilla)|0d 0a|"; ^ should be content:"|0d 0a|User-Agent\: NSI SDL/1.2 (Mozilla)|0d 0a|"; Regards, Markus