Custom signature for catch specific query

[jsv93]

Hello all

I'm trying to catch suspicious ldap queries (recon activity).
For the example I want catch this kind of querie : (primaryGroupID=512)

I tried to make a custom rule. However for ldap, there are only 2 possibilities:
- ldap-req-searchrequest-baseobject
- ldap-rsp-searchresentry-objectname
both of them don't fit my needs cause they don't match the filter field.

I tried with unknown-req-tcp-payload but it did not work. Reading the forum I understood that I can't use this context since ldap is seen as a known application.
https://live.paloaltonetworks.com/t5/custom-signatures/custom-threat-signature-search-full-tcp-paylo...

So I'm running out of ideas to catch this kind of request.

If somebody have a tips 

Thank's

[nikoolayy1]

Please see if this helps as this is new feature in 10.0 with the enhanced signature match:

Solved: LIVEcommunity - Custom threat signature- search full TCP payload of any AppId - LIVEcommunit...

Enhanced Pattern-Matching Engine (paloaltonetworks.com)