Suricata

I've confirmed that alerts are generated on
- master-5.0.x
- master-6.0.x
- master

Initial analysis:

content:"-ExecutionPolicy"; is the fast_pattern.
Engine buffers up initial response body to ~40k, then inspects rest in smaller 16k chunks.
Chunk at offset ~83k hits contains the fast pattern.
Inspection then checks for the content:!"<html"; condition, but since it only has bytes ~83k to ~99k, it won't find it because its before the window.

FP can be avoided by anchoring the content:!<html"; startswith;. But this doesn't actually check the pattern, it just fails to match as we don't have data at offset 0.