alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (Agent and 5 or 6 digits)"; flow:established,to_server; http.user_agent; content:"Agent"; depth:5; pcre:"/^Agent\d{5,6}$/i"; http.host; content:!"cloud.10jqka.com.cn"; content:!".maxthon.com"; classtype:trojan-activity; sid:2013315; rev:15; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_12, deployment Perimeter, confidence Medium, signature_severity Major, tag User_Agent, updated_at 2022_05_03;)