alert http $EXTERNAL_NET any -> any any (msg:"ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt"; flow:established,to_server; http.uri; content:"/tmui/login.jsp/..|3b|/"; depth:20; metadata: former_category EXPLOIT; reference:cve,2020-5902; reference:url,support.f5.com/csp/article/K52145254; classtype:attempted-admin; sid:2030469; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2020_07_05, updated_at 2020_07_05;)