alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS FAKEIE 11.0 Minimal Headers (flowbit set)"; flow:established,to_server; flowbits:set,FakeIEMinimal; flowbits:noalert; http.user_agent; content:"|20|rv|3a|11.0"; fast_pattern; http.header; content:"|0d 0a|Cache-Control|3a 20|no-cache|0d 0a|"; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:!"|0d 0a|Accept"; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a|Cache-Control|0d 0a|"; startswith; reference:url,malware-traffic-analysis.net/2014/10/01/index.html; classtype:trojan-activity; sid:2019343; rev:4; metadata:created_at 2014_10_03, signature_severity Informational, updated_at 2024_02_28;)