alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER MS Site Server default login attempt"; flow:established,to_server; http.uri; content:"/SiteServer/Admin/knowledge/persmbr/"; nocase; http.header; content:"TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE"; fast_pattern; pcre:"/^Authorization|3A|\s*Basic\s+TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE=/smi"; reference:nessus,11018; classtype:web-application-attack; sid:2101817; rev:10; metadata:created_at 2010_09_23, signature_severity Unknown, updated_at 2024_05_05;)