How to block based on request content to a specific file?

Question

I've tried many times, I've added them all in order below, but I couldn't get any results. Where am I doing wrong?

First attempt

SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
        "id:1001, \
        deny, \
        t:none, \
        tag: 'Admin ajax post Silderz', chain"
        SecRule REQUEST_BODY "@rx Silderz"

Second attempt

SecRule REQUEST_FILENAME "^/wp-admin/admin-ajax\.php$" \
        "id:1001, \
        deny, \
        t:none, \
        tag: 'Admin ajax post Silderz', chain"
        SecRule REQUEST_BODY "action=Silderz\&nonce=\w{1,}"

Third attempt

SecRule REQUEST_FILENAME "^/wp-admin/admin-ajax\.php$" \
        "id:1001, \
        deny, \
        t:none, \
        tag: 'Admin ajax post Silderz', chain"
        SecRule REQUEST_BODY "^action=Silderz\&nonce=\w{1,}$"

This is outgoing FormData request;

action: 
Silderz
nonce: 
4e2cad2579

AND Request Headers;

:authority: www.bursterksed.com
:method: POST
:path: /wp-admin/admin-ajax.php
:scheme: https
accept: application/json, text/javascript, */*; q=0.01
accept-encoding: gzip, deflate, br
accept-language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7,az;q=0.6,de;q=0.5,fr;q=0.4,ru;q=0.3,pt;q=0.2,hu;q=0.1
content-length: 34
content-type: application/x-www-form-urlencoded; charset=UTF-8
.......
.......
.......

Answer 1

It's not working because I didn't specify the phase state. "phase:2" => REQUEST_BODY

The following rule set works fine.

SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
        "id:1001, \
        phase:2, \
        deny, \
        nolog, \
        t:none, \
        tag: 'Admin ajax post Silderz', chain"
        SecRule ARGS_NAMES|ARGS|REQUEST_BODY|REQUEST_HEADERS|XML "@rx ^action=Silderz\&nonce=\w{1,}" "t:lowercase"