alert http $HOME_NET any -> [!134.170.0.0/16,$EXTERNAL_NET] any (msg:"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5."; flow:established,to_server; threshold:type limit,track by_src,count 2,seconds 60; http.header; content:!"GeoVision"; http.user_agent; content:"|20|MSIE 5."; fast_pattern; nocase; http.host; content:!".microsoft.com"; endswith; content:!".trendmicro.com"; endswith; content:!".sony.net"; endswith; content:!".weather.com"; endswith; content:!".yahoo.com"; endswith; content:!".dellfix.com"; endswith; content:!".oncenter.com"; endswith; classtype:policy-violation; sid:2016870; rev:15; metadata:created_at 2013_05_21, confidence High, signature_severity Informational, updated_at 2020_09_17;)