921120	HTTP Response Splitting Attack
921130	HTTP Response Splitting Attack
921140	HTTP Header Injection Attack via headers
921150	HTTP Header Injection Attack via payload (CR/LF detected)
921160	HTTP Header Injection Attack via payload (CR/LF and header-name detected)
921151	HTTP Header Injection Attack via payload (CR/LF detected)
930100	Path Traversal Attack (/../)
930110	Path Traversal Attack (/../)
930120	OS File Access Attempt
930130	Restricted File Access Attempt
931100	Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address
931110	Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload
931120	Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)
931130	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
932100	Remote Command Execution: Unix Command Injection
932105	Remote Command Execution: Unix Command Injection
932110	Remote Command Execution: Windows Command Injection
932115	Remote Command Execution: Windows Command Injection
932120	Remote Command Execution: Windows PowerShell Command Found
932130	Remote Command Execution: Unix Shell Expression Found
932140	Remote Command Execution: Windows FOR/IF Command Found
932150	Remote Command Execution: Direct Unix Command Execution
932160	Remote Command Execution: Unix Shell Code Found
932170	Remote Command Execution: Shellshock (CVE-2014-6271)
932171	Remote Command Execution: Shellshock (CVE-2014-6271)
932180	Restricted File Upload Attempt
933100	PHP Injection Attack: PHP Open Tag Found
933110	PHP Injection Attack: PHP Script File Upload Found
933120	PHP Injection Attack: Configuration Directive Found
933130	PHP Injection Attack: Variables Found
933140	PHP Injection Attack: I/O Stream Found
933150	PHP Injection Attack: High-Risk PHP Function Name Found
933151	PHP Injection Attack: Medium-Risk PHP Function Name Found
933160	PHP Injection Attack: High-Risk PHP Function Call Found
933170	PHP Injection Attack: Serialized Object Injection
933180	PHP Injection Attack: Variable Function Call Found
941100	XSS Attack Detected via libinjection
941101	XSS Attack Detected via libinjection
941110	XSS Filter - Category 1: Script Tag Vector
941120	XSS Filter - Category 2: Event Handler Vector
941130	XSS Filter - Category 3: Attribute Vector
941140	XSS Filter - Category 4: Javascript URI Vector
941150	XSS Filter - Category 5: Disallowed HTML Attributes
941160	NoScript XSS InjectionChecker: HTML Injection
941170	NoScript XSS InjectionChecker: Attribute Injection
941180	Node-Validator Blacklist Keywords
941190	IE XSS Filters - Attack Detected.
941200	IE XSS Filters - Attack Detected.
941210	IE XSS Filters - Attack Detected.
941220	IE XSS Filters - Attack Detected.
941230	IE XSS Filters - Attack Detected.
941240	IE XSS Filters - Attack Detected.
941250	IE XSS Filters - Attack Detected.
941260	IE XSS Filters - Attack Detected.
941270	IE XSS Filters - Attack Detected.
941280	IE XSS Filters - Attack Detected.
941290	IE XSS Filters - Attack Detected.
941300	IE XSS Filters - Attack Detected.
941310	US-ASCII Malformed Encoding XSS Filter - Attack Detected.
941320	Possible XSS Attack Detected - HTML Tag Handler
941330	IE XSS Filters - Attack Detected.
941340	IE XSS Filters - Attack Detected.
941350	UTF-7 Encoding IE XSS - Attack Detected.
942100	SQL Injection Attack Detected via libinjection
942110	SQL Injection Attack: Common Injection Testing Detected
942120	SQL Injection Attack: SQL Operator Detected
942140	SQL Injection Attack: Common DB Names Detected
942150	SQL Injection Attack
942160	Detects blind sqli tests using sleep() or benchmark().
942170	Detects SQL benchmark and sleep injection attempts including conditional queries
942180	Detects basic SQL authentication bypass attempts 1/3
942190	Detects MSSQL code execution and information gathering attempts
942200	Detects MySQL comment-/space-obfuscated injections and backtick termination
942210	Detects chained SQL injection attempts 1/2
942220	Looking for integer overflow attacks, these are taken from skipfish, except 3.0.00738585072007e-308 is the "magic number" crash
942230	Detects conditional SQL injection attempts
942240	Detects MySQL charset switch and MSSQL DoS attempts
942250	Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections
942260	Detects basic SQL authentication bypass attempts 2/3
942270	Looking for basic sql injection. Common attack string for mysql, oracle and others.
942280	Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts
942290	Finds basic MongoDB SQL injection attempts
942300	Detects MySQL comments, conditions and ch(a)r injections
942310	Detects chained SQL injection attempts 2/2
942320	Detects MySQL and PostgreSQL stored procedure/function injections
942330	Detects classic SQL injection probings 1/3
942340	Detects basic SQL authentication bypass attempts 3/3
942350	Detects MySQL UDF injection and other data/structure manipulation attempts
942360	Detects concatenated basic SQL injection and SQLLFI attempts
942361	Detects basic SQL injection based on keyword alter or union
942370	Detects classic SQL injection probings 2/3
942380	SQL Injection Attack
942390	SQL Injection Attack
942400	SQL Injection Attack
942410	SQL Injection Attack
942430	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)
942440	SQL Comment Sequence Detected.
942450	SQL Hex Encoding Identified
942470	SQL Injection Attack
942480	SQL Injection Attack
943100	Possible Session Fixation Attack: Setting Cookie Values in HTML
943110	Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer
943120	Possible Session Fixation Attack: SessionID Parameter Name with No Referer
944100	Remote Command Execution: Suspicious Java class detected
944110	Remote Command Execution: Java process spawn (CVE-2017-9805)
944120	Remote Command Execution: Java serialization (CVE-2015-5842)
944130	Suspicious Java class detected
944200	Magic bytes Detected, probable java serialization in use
944210	Magic bytes Detected Base64 Encoded, probable java serialization in use
944240	Remote Command Execution: Java serialization (CVE-2015-5842)
944250	Remote Command Execution: Suspicious Java method detected