Expression like:
(http.user_agent contains "part-of-user-agent-we-want-to-block")
Depending on the attack type, if user-agents, crawlers, etc., there are few I would recommend to add to your Firewall Rules , like the posted here:
Firewall Rules