Rule History

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT Exploit MS05-002 Malformed .ANI stack overflow attack"; flow: to_client,established; content:"RIFF"; content:"ACON"; distance: 8; content:"anih"; distance: 160; byte_test:4,>,36,0,relative,little; classtype:misc-attack; sid:2001668; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Major, updated_at 2019_07_26;)