IPS Signature

[Reshma Raje]

We sometimes receive attacks on this signature 'WWW WinNT cmd.exe Access' and are stopped by IPS.

Can someone help me understand what exactly is signature?

[Marvin Rhoads]

As explained here:

https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=5081&signatureSubId=0&soft_1

...it's when cmd.exe is detected in a URL.

There's no good reason why any legitimate web site would invoke cmd.exe thus it is blocked in the default IPS signature set.

[Reshma Raje]

Thank you for your response Marvin. 

Can you help me further understand, is the URL in such cases an internal URL or external URL.

If it's an internal URL, does it mean that there was an external attack on the internal URL.