alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; reference:url,doc.emergingthreats.net/bin/view/Main/2001846; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/DOS/DOS_MS05-019; sid:2001846; rev:12; )

Added 2010-06-23 13:46:09 UTC

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; reference:url,doc.emergingthreats.net/bin/view/Main/2001846; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/DOS/DOS_MS05-019; sid:2001846; rev:12; )

Added 2010-06-23 13:46:09 UTC

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; reference:url,doc.emergingthreats.net/bin/view/Main/2001846; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/DOS/DOS_MS05-019; sid: 2001846; rev:12; )

Added 2009-02-06 19:00:55 UTC

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; reference:url,doc.emergingthreats.net/bin/view/Main/2001846; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/DOS/DOS_MS05-019; sid: 2001846; rev:12; )

Added 2009-02-06 19:00:55 UTC

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:11; )

Added 2008-05-18 19:52:13 UTC

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:11; )

Added 2008-05-18 19:52:13 UTC

alert icmp any any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:10; )

Added 2008-01-25 10:03:39 UTC

alert icmp any any -> $HOME_NET any (msg: "ET DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:10; )

Added 2008-01-25 10:03:39 UTC

alert icmp any any -> $HOME_NET any (msg: "BLEEDING-EDGE DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: 1<>5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:10; )

Added 2007-07-26 00:46:15 UTC

#alert icmp any any -> $HOME_NET any (msg: "BLEEDING-EDGE DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: >1<5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:9; )

Added 2007-07-25 23:46:16 UTC

alert icmp any any -> $HOME_NET any (msg: "BLEEDING-EDGE DOS -ISC- ICMP blind TCP reset DoS? guessing attempt"; itype: 3; icode: >1<5; byte_test:1,=,6,17;threshold: type threshold, track by_dst, count 30, seconds 300; reference:cve,can-2004-0790; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; classtype: attempted-dos; sid: 2001846; rev:9; )