Rule name: "Skopnix: CVE-2009-1872 exploitation attempt"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [your web server / WAF / proxy log sources]
  - and when the event matches this AQL filter query: ("URL" ILIKE '%/CFIDE/wizards/common/_logintowizard.cfm%' AND "URL" ILIKE '%%22%3E%3C%2Fscript%3E%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E%')
Response: dispatch new event / create offense indexed by Destination IP (the targeted server); annotate "Skopnix CVE-2009-1872 attempt".
FP-safety: correlate with the HTTP status / response size; scanner noise is an attempt, not a breach.