alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Empty User-Agent"; flow:to_server,established; http.header; content:"User-Agent|3a 20 0d 0a|"; http.host; content:!"connectivitycheck.gstatic.com"; endswith; content:!".mcafee.com"; content:!"deezer.com"; endswith; content:!"googlezip.net"; content:!"metrics.tbliab.net"; endswith; content:!"dajax.com"; endswith; content:!"update.eset.com"; endswith; content:!".sketchup.com"; endswith; content:!".yieldmo.com"; endswith; content:!"ping-start.com"; endswith; content:!".bluekai.com"; content:!".stockstracker.com"; content:!".doubleclick.net"; content:!".pingstart.com"; content:!".colis-logistique.com"; content:!"android-lrcresource.wps.com"; content:!"track.package-buddy.com"; content:!"talkgadget.google.com"; endswith; content:!".visualstudio.com"; endswith; content:!".slack-edge.com"; endswith; content:!".slack.com"; endswith; content:!".lifesizecloud.com"; endswith; classtype:unknown; sid:2007994; rev:24; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, confidence Medium, signature_severity Major, tag User_Agent, updated_at 2022_12_28;)