alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Ipconfig Response Detected"; flow:established,to_client; content:"Windows IP Configuration"; content:"Ethernet adapter Local Area Connection"; offset:35; depth:55; reference:url,en.wikipedia.org/wiki/Ipconfig; classtype:successful-recon-limited; sid:2009676; rev:5; metadata:created_at 2010_07_30, signature_severity Informational, updated_at 2024_03_06;)