With vmod_re, you acn also specifically match contents: https://vinyl-cache.org/tutorials/body_regex.html#search-client-request-bodies-in-vcl-recv

This might become useful once specific patterns indicating attack vectors become known.