alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"VEDAS CVE-2026-85746 MariaDB - Heap Buffer Overflow Attempt"; flow:established,to_server; content:"ST_AsText"; nocase; content:"GEOMETRYCOLLECTION(GEOMETRYCOLLECTION("; nocase; fast_pattern; classtype:attempted-admin; reference:cve,CVE-2026-85746; reference:url,https://www.exploit.observer/?keyword=CVE-2026-85746&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=mariadb&match=exact; sid:1078600; rev:1;)