alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Malformed Double Accept Header"; flow:established,to_server; http.user_agent; content:!"-DRM"; http.host; content:!"buhphone.ru"; content:!"www.backupmaker.com"; content:!"ati.com"; content:!"amd.com"; endswith; http.accept; content:"Accept|3a 20|"; fast_pattern; classtype:policy-violation; sid:2008975; rev:18; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2020_09_16;)