Rules with sticky buffers and content modifiers

This is my understanding of how this works. In your example “key=” would match anywhere in the reassembled stream, “Referer|0d 0a|” and “User-Agent” would match the http_header_names buffer and “data=” would match the http_connection buffer.

All content matches following a sticky buffer will apply to that buffer as well as most other content matching keywords. I mix sticky buffers and content modifiers like this to avoid confusion:

content:"modifier match" http_uri; content:"full stream match"; content:"modifier match"; http_uri; http_header_names; content:"sticky match"; content:"sticky 2;