alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-CLIENT IE html style * position relative DoS attempt"; flow:to_client,established; content:"<style"; nocase; content:"*"; within:10; distance:0; content:"position"; nocase; within:15; distance:0; content:"relative"; nocase; within:15; distance:0; content:"</style"; nocase; within:15; distance:0; pcre:!"/\<style[0-9a-z]/i"; reference:bugtraq,28027; classtype:web-application-activity; sid:92626; rev:1;)