Yes, The above rule will work to deny any requests or block requests with the 'form' selector.
Did you get a chance to check the logs to get more details on the hackers URL - find out how they were able to download a trust store file.
Generaly - The truststore file is used to store certificates th...