alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Farfli User Agent Detected"; flow:established,to_server; http.uri; content:"/rpt"; fast_pattern; startswith; http.user_agent; bsize:>91; content:!"Mozilla"; pcre:"/[a-z0-9]{92}/mi"; classtype:trojan-activity; sid:2007646; rev:10; metadata:created_at 2010_07_30, confidence High, signature_severity Major, updated_at 2024_02_16;)