alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Microsoft Powershell Banner Outbound"; flow:established; content:"Windows PowerShell"; nocase; content:"Copyright |28|C|29|"; distance:0; nocase; content:"Microsoft Corp"; distance:0; nocase; classtype:successful-admin; sid:2020084; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_01_05, deployment Perimeter, confidence High, signature_severity Minor, updated_at 2024_12_12, reviewed_at 2024_03_26;)