IE Action Handler Overflow

[mcartoz33]

Has anyone else been seeing large occurences of this signature from what appears to be normal web application/browsing activity? No further tuning of the sig has been performed.

[hendetl]

Just waiting on the tuned sig - I hope, I hope, I hope. If it doesn't come soon, we'll have to filter it or turn it off.

[jdal]

If you are seeing that signature firing, that means you or your users are browsing a web page including more than 2000 script action handlers.

That is possible but shouldn't be so common. I'd suggest to increase the Event Count value to something bigger.

The risk in this case would be to miss a real attack.