I hope snort can find it

[gleader at gmail.com (gleader)]

I am researching the security manager ,
I test ossim cross correlation. host vulnerability and exploit event
correlation.
I use metasploit use the dcerpc/ms03_026_dcom ,everything is ok.
but i hope my snort can find the attack.
what can i do?set encode or nop?
please help me.
thanks giving