#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"BLEEDING-EDGE CURRENT WMF POC CreateBrushIndirect? DoS?"; flow:established; content:"|08 00 00 00 FA 02 00 00 00 00 00 00 00 00 00 00 07 00 00 00 FC 02 08 00 00 00 00 00 00 80 03 00|"; reference:url,determina.blogspot.com/2007/01/whats-wrong-with-wmf.html; reference:url,www.milw0rm.com/exploits/3111; classtype:attempted-user; sid:2003252; rev:3;)