ASM Regex rule

Within the re2 content you need to delimit the regex with "/":

re2:"/[a,A][n,N][d,D]\W\'[a-z,A-Z]\'=\'[a-z,A-Z]/";

As the rule is written above there will be a conflict between the Value Content and the general content targeted in the regex.

Either set the rule to target a different content type or set the modifier in the re2 to other than general.

Example:

Header content

headercontent:"XXX"; nocase; re2:"/[a,A][n,N][d,D]\W\'[a-z,A-Z]\'=\'[a-z,A-Z]/";

Setting the re2 to parameter and value pairs, or XML or JSON data payloads:

valuecontent:"XXX"; nocase; norm; re2:"/[a,A][n,N][d,D]\W\'[a-z,A-Z]\'=\'[a-z,A-Z]/Vi";

There are a couple of useful resources for review:

https://devcentral.f5.com/articles/asm-custom-signatures-oh-my

https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-2-0/asm_apx_attack_sig_syntax.html998646