#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE CURRENT EVENTS Microsoft acf File Access (Microsoft Agent Memory Corruption)"; flow:from_client,established; uricontent:".acf"; reference:url,www.microsoft.com/technet/security/bulletin/ms06-068.mspx; classtype:attempted-user; sid:2003177; rev:1; )