alert tcp any any -> $DNS_SERVERS 1024: (msg:"BLEEDING-EDGE CURRENT EVENTS DNS RPC Exploit (specific to Metasploit Module)"; flow:to_server,established; flowbits:isset,BE.ms.dns.rpc; content:"|05|"; depth:1; content:"|10|"; distance:3; within:1; content:"|01 00|"; distance:17; within:2; reference:url,doc.bleedingthreats.net/bin/view/Main/MSRpcDns; sid:2003593; rev:2;)

Added 2007-05-03 16:30:19 UTC

alert tcp any any -> any 1024: (msg:"BLEEDING-EDGE CURRENT EVENTS DNS RPC Exploit (specific to Metasploit Module)"; flow:to_server,established; flowbits:isset,BE.ms.dns.rpc; content:"|05|"; depth:1; content:"|10|"; distance:3; within:1; content:"|01 00|"; distance:17; within:2; reference:url,doc.bleedingthreats.net/bin/view/Main/MSRpcDns; sid:2003593; rev:1;)

Added 2007-04-17 19:30:22 UTC

MSRpcDns?

-- MattJonkman - 17 Apr 2007