alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET EXPLOIT MS05-005 Office XP .doc Remote Code Attempt"; flow:established,to_server; uricontent:".doc"; pcre:"/\x2edoc\x2500.{500}/isU"; classtype:attempted-admin; reference:cve,2004-0848; reference:url,www.frsirt.com/english/advisories/2005/0119; reference:url,doc.emergingthreats.net/bin/view/Main/2001727; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_MS05-005; sid:2001727; rev:9;)

Added 2009-02-07 22:00:25 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET EXPLOIT MS05-005 Office XP .doc Remote Code Attempt"; flow:established,to_server; uricontent:".doc"; pcre:"/\x2edoc\x2500.{500}/isU"; classtype:attempted-admin; reference:cve,2004-0848; reference:url,www.frsirt.com/english/advisories/2005/0119; reference:url,doc.emergingthreats.net/bin/view/Main/2001727; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/EXPLOIT/EXPLOIT_MS05-005; sid:2001727; rev:9;)

Added 2009-02-07 22:00:25 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET EXPLOIT MS05-005 Office XP .doc Remote Code Attempt"; flow:established,to_server; uricontent:".doc"; pcre:"/\x2edoc\x2500.{500}/isU"; classtype:attempted-admin; reference:cve,2004-0848; reference:url,www.frsirt.com/english/advisories/2005/0119; sid:2001727; rev:8;)

Added 2008-01-25 10:56:38 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET EXPLOIT MS05-005 Office XP .doc Remote Code Attempt"; flow:established,to_server; uricontent:".doc"; pcre:"/\x2edoc\x2500.{500}/isU"; classtype:attempted-admin; reference:cve,2004-0848; reference:url,www.frsirt.com/english/advisories/2005/0119; sid:2001727; rev:8;)

Added 2008-01-25 10:56:38 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE EXPLOIT MS05-005 Office XP .doc Remote Code Attempt"; flow:established,to_server; uricontent:".doc"; pcre:"/\x2edoc\x2500.{500}/isU"; classtype:attempted-admin; reference:cve,2004-0848; reference:url,www.frsirt.com/english/advisories/2005/0119; sid:2001727; rev:7;)