Block An automated SQLI

Help
1

AM still new to suricata. got an alert from my splunk . (Note: this is for learning purpose)
10.157.31.87 - - [02/Jan/2021:17:30:50 +0000] "GET /images.php?id=bXlzcWwgLS11c2VyPXJvb3QgLS1wYXNzd29yZD1yb290Cg== HTTP/1.1" 200 31 "-" "curl/7.58.0"

i tried this rule its not working am stuck any help will appreciate it.

drop http 10.63.120.219 any -> any any (msg:"sql bruteforce"; priority: 1; uricontent:"GET /images.php?"; sid:10000001; rev: 1;)

2

Have a look at 6.12. HTTP Keywords — Suricata 6.0.1 documentation
The GET part of the request should not be in the content match. I would also advise against using uricontent as it’s an old keyword.

An alternative would be drop http 10.63.120.219 any -> any any (msg:"sql bruteforce"; priority: 1; http.method; content:"GET"; http.uri; content:"/images.php?"; sid:10000001; rev: 1;)