This signature detects when the ITS protocol handler is used to exploit this vulnerability. There are other methods available to redirect Internet Explorer into the Local Machine Zone; however, the ITS method has been the most common in recent attacks.
