312-39V2: Certified SOC Analyst v2

A financial services company operates an online banking platform that is available through a public web portal. The SOC team has deployed Snort IDS to monitor HTTP traffic for possible attacks aimed at the login page. One day, a user makes multiple login attempts, creating a series of failed authentication events. During this period, Snort IDS generates an alert based on the following rule:

alert tcp any any -> any 80 (msg:"SQL Injection attempt detected"; content:“‘ OR ’1‘=’l”; nocase; sid:1000001; rev:1;)

The alert shows that an incoming HTTP request included the classic SQL injection payload ‘ OR ’1‘=’l, commonly used to bypass login authentication because it always evaluates as true. The SIEM, integrated with Snort, receives the alert and correlates it with multiple failed login attempts from the same source IP. This initiates an automated response that temporarily blocks the suspicious IP address and notifies the SOC team. Which detection method does this rule use?