@snort   =("large","packet","bad","traffic","inbound","attempt","web","IIS","cmd.exe","cgi","access","multiple","decode");