alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Ipconfig Response Detected"; flow:from_server,established; content:"Windows IP Configuration"; content:"Ethernet adapter Local Area Connection"; offset:35; depth:55; reference:url,en.wikipedia.org/wiki/Ipconfig; classtype:successful-recon-limited; sid:2009676; rev:4; metadata:created_at 2010_07_30, signature_severity Informational, updated_at 2019_07_26;)