alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY TeamViewer Dyngate User-Agent"; flow:established,to_server; threshold:type limit, count 1, seconds 120, track by_src; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|DynGate)"; fast_pattern; depth:43; reference:url,www.teamviewer.com/index.aspx; classtype:policy-violation; sid:2009475; rev:12; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2020_06_02;)