alert tcp any any -> $DNS_SERVERS 1024: (msg:"BLEEDING-EDGE CURRENT EVENTS Vulnerable DNS RPC Bind"; flow:to_server,established; content:"|a4 c2 ab 50 4d 57 b3 40 9d 66 ee 4f d5 fb a0 76|"; flowbits:set,BE.ms.dns.rpc; reference:url,doc.bleedingthreats.net/bin/view/Main/MSRpcDns; sid:2003592; rev:2;)

Added 2007-05-03 16:30:19 UTC

alert tcp any any -> any 1024: (msg:"BLEEDING-EDGE CURRENT EVENTS Vulnerable DNS RPC Bind"; flow:to_server,established; content:"|a4 c2 ab 50 4d 57 b3 40 9d 66 ee 4f d5 fb a0 76|"; flowbits:set,BE.ms.dns.rpc; reference:url,doc.bleedingthreats.net/bin/view/Main/MSRpcDns; sid:2003592; rev:1;)

Added 2007-04-17 19:30:22 UTC

See MSRpcDns?

-- MattJonkman - 17 Apr 2007