BTW -- sig 26653 also catches this.
On Jun 19, 2013, at 9:46 AM, Joel Esler <jesler () sourcefire com >
I have rules that will ship in the next rule pack for these already
written. I'll add the community tag to them so they go out for free.