alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Mac User-Agent Typo INBOUND Likely Hostile"; flow:established,to_server; http.user_agent; content:"Mozilla/5.0 (Macintosh|3b|"; depth:23; content:"(KHTML, like Geco,"; distance:0; fast_pattern; classtype:trojan-activity; sid:2008955; rev:9; metadata:created_at 2010_07_30, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_14;)