I’m not really sure what kind of information you’re looking for; if you could be more specific I would be happy to answer any questions you may have. In the meantime here is a brief description of these signatures.
Signatures 5366.x look for an attempt to overflow an HTTP get request by sending shell code (non-printable) to in a request to the server.
Signature 5351 looks for an attempt to overflow a call to MS help by overflowing the ‘value’ argument.
Signature 9232, which is disabled by default, simply looks for a syn-ack from port 5190.
Signatures 5322.x look for a long HTTP request by examining the (.1) arguments field and (.0) the URI field.
Signature 5124 looks for a request being sent to a server that could exploit the IIS decode bug. The signature description in the NSDB states that: “This signature triggers when an doubly obfuscated attempt to traverse the directory structure of a web server is detected. Certain versions of the IIS web server perform a second pass decode of the arguments passed to a CGI program. During this second pass decode, the IIS server erroneously reevaluates the already decoded path portion of the URL. An attacker can manipulate the path portion of a URL in such a way as to hide characters, such as ../, which would normally be filtered out during the first pass decode of the URL. This signature will alarm if the following characters are found in a deobfuscated HTTP request.”
