more sophisticated idss look for common shellcode signatures but even these systems can be bypassed by using polymorphic shellcode this is a technique common among virus writers