alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:NETBIOS DCERPC ISystemActivator bind attempt; flow:to_server established; content:|05|; distance:0; within:1; content:|0b|; distance:1; within:1; b