alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Virtual Rooms Control Clsid Access"; flow:established,to_client; file.data; content:"00000032-9593-4264-8B29-930B3E4EDCCD"; fast_pattern; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD/si"; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01678405; classtype:attempted-user; sid:2009404; rev:10; metadata:created_at 2010_07_30, confidence Medium, signature_severity Unknown, updated_at 2024_04_10;)