title: Snort Rule - HTTP Body Content
body: <p>I am trying to create a simple rule to alert when "MZ" are the first two characters in the HTTP body.</p>
  
  <p>My current rule is:</p>
  
  <pre><code>alert tcp any any -&gt; any any (msg:"Test"; content:"MZ"; depth: 2; http_client_body; sid:51; rev:1;)
  </code></pre>
  
  <p>But this finds no results despite "MZ" definitely being present in the HTTP body.</p>
  
  <p>Assistance much appreciated.</p>