alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious UA (^IE[\d\s])"; flow:established,to_server; http.header; content:!"symantec"; nocase; content:!"norton"; nocase; http.user_agent; content:"IE"; depth:2; nocase; fast_pattern; pcre:"/^[\d\s]/R"; http.host; content:!".bing.com"; reference:md5,209e6701da137084c2f60c90d64505f2; classtype:trojan-activity; sid:2018010; rev:6; metadata:created_at 2014_01_24, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_18;)