# rule:
alert tcp any any -> any any (msg:"jumpserver_rce"; sid:364; content:"POST"; uricontent:"/api/v1/users/connection-token/?user-only=1"; rev:1; metadata:aes team rules;)
# rule:
alert tcp any any -> any any (msg:"jumpserver_rce"; sid:364; content:"POST"; uricontent:"/api/v1/users/connection-token/?user-only=1"; rev:1; metadata:aes team rules;)