alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT MSSQL Hello Overflow Attempt"; flow:established,to_server; dsize:>400; content:"|12 01 00 34 00 00 00 00|"; offset:0; depth:8; reference:cve,2002-1123; reference:bugtraq,5411; classtype:attempted-admin; sid:2002845; rev:5; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, updated_at 2019_07_26;)