Rule:--Sid:12686--Summary:This event is generated when network traffic that indicates AIM Express is being used.--Impact:Possible policy violation. The use of AIM Express may be prohibited by corporate policy in some network environments. --Detailed Information:This event indicates that the AIM Express is being used on the protected network.--Affected Systems:All systems using AIM Express--Attack Scenarios:This is a possible policy violation, it may be that AIM Express has been installated on a client host.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:None known.--Corrective Action:Disallow the use of AIM Express on the protected network and enforce or implement an organization wide policy on the use of AIM Express.--Contributors:Sourcefire Vulnerability Research Team--Additional References:--