drop tcp any any -> any any (msg:"ssms.exe";flow:established;content:"/ssms.exe"; classtype:misc-attack; reference:url,ssms.exe;sid:6000008;)
drop tcp any any -> any any (msg:"priv.exe";flow:established;content:"/priv.exe"; classtype:misc-attack; reference:url,priv.exe;sid:6000009;)
drop tcp any any -> any any (msg:"msblast.exe";flow:established;content:"/msblast.exe"; classtype:misc-attack; reference:url,msblast.exe;sid:6000010;)
drop tcp any any -> any any (msg:"msv.exe";flow:established;content:"/msv.exe"; classtype:misc-attack; reference:url,msv.exe;sid:6000011;)
drop tcp any any -> any any (msg:"Tracker.exe";flow:established;content:"/Tracker.exe"; classtype:misc-attack; reference:url,Tracker.exe;sid:6000012;)
drop tcp any any -> any any (msg:"x.exe";flow:established;content:"/x.exe"; classtype:misc-attack; reference:url,x.exe;sid:6000013;)
drop tcp any any -> any any (msg:"c.exe";flow:established;content:"/c.exe"; classtype:misc-attack; reference:url,c.exe;sid:6000014;)
drop tcp any any -> any any (msg:"sys.exe";flow:established;content:"/sys.exe"; classtype:misc-attack; reference:url,sys.exe;sid:6000015;)
drop tcp any any -> any any (msg:"mslaugh.exe";flow:established;content:"/mslaugh.exe"; classtype:misc-attack; reference:url,mslaugh.exe;sid:6000016;)