alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN McAfee/Foundstone Scanner Web Scan"; flow:established,to_server; http.user_agent; bsize:44; content:"Mozilla/5.0 (Windows|3b 20|Windows NT 6.1|3b 20|en-US)"; fast_pattern; http.accept_enc; bsize:4; content:"text"; threshold:type both, count 2, seconds 120, track by_src; reference:url,www.mcafee.com/us/products/vulnerability-manager.aspx; classtype:attempted-recon; sid:2013492; rev:6; metadata:created_at 2011_08_30, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_10;)