2788647047_rules

alert tcp any any -> any (msg:"Possible Sunlogin RCE attempt"; content:"/check?cmd="; pcre:"/cmd=(ping|nslookup).*/i"; sid:1000001; rev:1;)