I think the \ before in \(msg:" and \) at the end are probably messing this up.
Can you try removing those and seeing what happens? If that works, then the issue is how/why are those getting in the rule. What ruleset manager are you using?
I think the \ before in \(msg:" and \) at the end are probably messing this up.
Can you try removing those and seeing what happens? If that works, then the issue is how/why are those getting in the rule. What ruleset manager are you using?