alert tcp any any -> $WEBSERVER 80 (msg:"IIS unicode directory traversal"; uricontent:"/../"; flow:to_server,established; react: block, msg; classtype:web-application-attack; reference:cve,CVE-2000-0884; reference:bugtraq,1806; sid:1000001; rev:1)