The main goal of the rule is to detect packets with the “20 6b” sequence, which is located in the Request Path section.
Since the length of the Request Path block always changes, I want to use the Request Path Size static field value, which specifies the size of the Request Path section.
With the byte_extract option, we take the value of the Request Path Size field into the variable “len” (decimal).
In the byte_math option, we again take the value of the Request Path Size field and add it to “len”. We write all this into the variable “var” (decimal number). This is done instead of multiplication, which is not supported in my version of Suricata.
Next, we use “var” in the “depth” option to specify the depth to search for the “content” and “offset” options.