SecRule REQUEST_URI "(/connectors/system/phpthumb|/assets/components/gallery/connector)" "chain,phase:2,id:403001,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block,\
    severity:CRITICAL,\
    msg:'Modx Revolution < 2.6.4 - Remote Code Execution',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
SecRule ARGS_POST:IMresizedData "^(?i:.{0,40}(ok|<\?php))" \
    "setvar:tx.bn_inbound_found=+1"