# 17/07/2008 WinRemotePC Packet Handling Denial of Service

alert tcp $EXTERNAL_NET any -> $HOME_NET 4321 (msg:"WinRemotePC Packet Handling Remote Denial of Service"; flow:to_server,established; content:"|36 46 32 45 30 31 37 30|"; distance:0; content:"|30 44 35 33 39 38 39 36 46 30 31 35|"; distance:0; pcre:"/[a-zA-Z0-9]{256,}/"; reference:bugtraq,30236; reference:url,milw0rm.com/exploits/6077; classtype:successful-dos; sid:9007; rev:1;)