I'm trying to get a signature to work which is looking for a specific server response HTTP header, namely: content:"|0d 0a|Content-Disposition: attachment|3b| filename="; If I add "http_header" as a modifier, it doesn't hit. Client stuff seems to work fine. I'm using the default libhtp config. Suggestions?