alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET POLICY Inbound HTTP Brotli Compressed Request"; flow:established,to_server; http.content_type; content:"application/octet-stream"; http.header; content:"content-encoding|3a 20|br"; fast_pattern; nocase; reference:url,www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/; reference:cve,2026-111497; classtype:web-application-activity; sid:2072656; rev:1; metadata:attack_target Web_Server, created_at 2026_11_09, deployment Perimeter, performance_impact Moderate, confidence High, signature_severity Unknown, updated_at 2026_11_09; target:dest_ip;)